xref: /freebsd/sys/contrib/dev/mediatek/mt76/mt7915/mcu.c (revision e9ac41698b2f322d55ccf9da50a3596edb2c1800)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include "mt7915.h"
6 #include "mcu.h"
7 #include "mac.h"
8 #include "eeprom.h"
9 
10 #define fw_name(_dev, name, ...)	({			\
11 	char *_fw;						\
12 	switch (mt76_chip(&(_dev)->mt76)) {			\
13 	case 0x7915:						\
14 		_fw = MT7915_##name;				\
15 		break;						\
16 	case 0x7981:						\
17 		_fw = MT7981_##name;				\
18 		break;						\
19 	case 0x7986:						\
20 		_fw = MT7986_##name##__VA_ARGS__;		\
21 		break;						\
22 	default:						\
23 		_fw = MT7916_##name;				\
24 		break;						\
25 	}							\
26 	_fw;							\
27 })
28 
29 #define fw_name_var(_dev, name)		(mt7915_check_adie(dev, false) ?	\
30 					 fw_name(_dev, name) :			\
31 					 fw_name(_dev, name, _MT7975))
32 
33 #define MCU_PATCH_ADDRESS		0x200000
34 
35 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
36 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
37 
38 static bool sr_scene_detect = true;
39 module_param(sr_scene_detect, bool, 0644);
40 MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
41 
42 static u8
43 mt7915_mcu_get_sta_nss(u16 mcs_map)
44 {
45 	u8 nss;
46 
47 	for (nss = 8; nss > 0; nss--) {
48 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
49 
50 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
51 			break;
52 	}
53 
54 	return nss - 1;
55 }
56 
57 static void
58 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
59 			  u16 mcs_map)
60 {
61 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
62 	struct mt7915_dev *dev = msta->vif->phy->dev;
63 	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
64 	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
65 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
66 
67 	for (nss = 0; nss < max_nss; nss++) {
68 		int mcs;
69 
70 		switch ((mcs_map >> (2 * nss)) & 0x3) {
71 		case IEEE80211_HE_MCS_SUPPORT_0_11:
72 			mcs = GENMASK(11, 0);
73 			break;
74 		case IEEE80211_HE_MCS_SUPPORT_0_9:
75 			mcs = GENMASK(9, 0);
76 			break;
77 		case IEEE80211_HE_MCS_SUPPORT_0_7:
78 			mcs = GENMASK(7, 0);
79 			break;
80 		default:
81 			mcs = 0;
82 		}
83 
84 		mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
85 
86 		switch (mcs) {
87 		case 0 ... 7:
88 			mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
89 			break;
90 		case 8 ... 9:
91 			mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
92 			break;
93 		case 10 ... 11:
94 			mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
95 			break;
96 		default:
97 			mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
98 			break;
99 		}
100 		mcs_map &= ~(0x3 << (nss * 2));
101 		mcs_map |= mcs << (nss * 2);
102 
103 		/* only support 2ss on 160MHz for mt7915 */
104 		if (is_mt7915(&dev->mt76) && nss > 1 &&
105 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
106 			break;
107 	}
108 
109 	*he_mcs = cpu_to_le16(mcs_map);
110 }
111 
112 static void
113 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
114 			   const u16 *mask)
115 {
116 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
117 	struct mt7915_dev *dev = msta->vif->phy->dev;
118 	u16 mcs_map = le16_to_cpu(sta->deflink.vht_cap.vht_mcs.rx_mcs_map);
119 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
120 	u16 mcs;
121 
122 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
123 		switch (mcs_map & 0x3) {
124 		case IEEE80211_VHT_MCS_SUPPORT_0_9:
125 			mcs = GENMASK(9, 0);
126 			break;
127 		case IEEE80211_VHT_MCS_SUPPORT_0_8:
128 			mcs = GENMASK(8, 0);
129 			break;
130 		case IEEE80211_VHT_MCS_SUPPORT_0_7:
131 			mcs = GENMASK(7, 0);
132 			break;
133 		default:
134 			mcs = 0;
135 		}
136 
137 		vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
138 
139 		/* only support 2ss on 160MHz for mt7915 */
140 		if (is_mt7915(&dev->mt76) && nss > 1 &&
141 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
142 			break;
143 	}
144 }
145 
146 static void
147 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
148 			  const u8 *mask)
149 {
150 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
151 
152 	for (nss = 0; nss < max_nss; nss++)
153 		ht_mcs[nss] = sta->deflink.ht_cap.mcs.rx_mask[nss] & mask[nss];
154 }
155 
156 static int
157 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
158 			  struct sk_buff *skb, int seq)
159 {
160 	struct mt76_connac2_mcu_rxd *rxd;
161 	int ret = 0;
162 
163 	if (!skb) {
164 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
165 			cmd, seq);
166 		return -ETIMEDOUT;
167 	}
168 
169 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
170 	if (seq != rxd->seq &&
171 	    !(rxd->eid == MCU_CMD_EXT_CID &&
172 	      rxd->ext_eid == MCU_EXT_EVENT_WA_TX_STAT))
173 		return -EAGAIN;
174 
175 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
176 		skb_pull(skb, sizeof(*rxd) - 4);
177 		ret = *skb->data;
178 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
179 		skb_pull(skb, sizeof(*rxd) + 4);
180 		ret = le32_to_cpu(*(__le32 *)skb->data);
181 	} else {
182 		skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
183 	}
184 
185 	return ret;
186 }
187 
188 static int
189 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
190 			int cmd, int *wait_seq)
191 {
192 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
193 	enum mt76_mcuq_id qid;
194 	int ret;
195 
196 	ret = mt76_connac2_mcu_fill_message(mdev, skb, cmd, wait_seq);
197 	if (ret)
198 		return ret;
199 
200 	if (cmd == MCU_CMD(FW_SCATTER))
201 		qid = MT_MCUQ_FWDL;
202 	else if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
203 		qid = MT_MCUQ_WA;
204 	else
205 		qid = MT_MCUQ_WM;
206 
207 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
208 }
209 
210 int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
211 {
212 	struct {
213 		__le32 args[3];
214 	} req = {
215 		.args = {
216 			cpu_to_le32(a1),
217 			cpu_to_le32(a2),
218 			cpu_to_le32(a3),
219 		},
220 	};
221 
222 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), false);
223 }
224 
225 static void
226 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
227 {
228 	if (vif->bss_conf.csa_active)
229 		ieee80211_csa_finish(vif);
230 }
231 
232 static void
233 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
234 {
235 	struct mt76_phy *mphy = &dev->mt76.phy;
236 	struct mt7915_mcu_csa_notify *c;
237 
238 	c = (struct mt7915_mcu_csa_notify *)skb->data;
239 
240 	if (c->band_idx > MT_BAND1)
241 		return;
242 
243 	if ((c->band_idx && !dev->phy.mt76->band_idx) &&
244 	    dev->mt76.phys[MT_BAND1])
245 		mphy = dev->mt76.phys[MT_BAND1];
246 
247 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
248 			IEEE80211_IFACE_ITER_RESUME_ALL,
249 			mt7915_mcu_csa_finish, mphy->hw);
250 }
251 
252 static void
253 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
254 {
255 	struct mt76_phy *mphy = &dev->mt76.phy;
256 	struct mt7915_mcu_thermal_notify *t;
257 	struct mt7915_phy *phy;
258 
259 	t = (struct mt7915_mcu_thermal_notify *)skb->data;
260 	if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
261 		return;
262 
263 	if (t->ctrl.band_idx > MT_BAND1)
264 		return;
265 
266 	if ((t->ctrl.band_idx && !dev->phy.mt76->band_idx) &&
267 	    dev->mt76.phys[MT_BAND1])
268 		mphy = dev->mt76.phys[MT_BAND1];
269 
270 	phy = (struct mt7915_phy *)mphy->priv;
271 	phy->throttle_state = t->ctrl.duty.duty_cycle;
272 }
273 
274 static void
275 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
276 {
277 	struct mt76_phy *mphy = &dev->mt76.phy;
278 	struct mt7915_mcu_rdd_report *r;
279 
280 	r = (struct mt7915_mcu_rdd_report *)skb->data;
281 
282 	if (r->band_idx > MT_RX_SEL2)
283 		return;
284 
285 	if ((r->band_idx && !dev->phy.mt76->band_idx) &&
286 	    dev->mt76.phys[MT_BAND1])
287 		mphy = dev->mt76.phys[MT_BAND1];
288 
289 	if (r->band_idx == MT_RX_SEL2)
290 		cfg80211_background_radar_event(mphy->hw->wiphy,
291 						&dev->rdd2_chandef,
292 						GFP_ATOMIC);
293 	else
294 		ieee80211_radar_detected(mphy->hw);
295 	dev->hw_pattern++;
296 }
297 
298 static void
299 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
300 {
301 	struct mt76_connac2_mcu_rxd *rxd;
302 	int len = skb->len - sizeof(*rxd);
303 	const char *data, *type;
304 
305 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
306 	data = (char *)&rxd[1];
307 
308 	switch (rxd->s2d_index) {
309 	case 0:
310 #if !defined(__FreeBSD__) || defined(CONFIG_MT7915_DEBUGFS)
311 		if (mt7915_debugfs_rx_log(dev, data, len))
312 			return;
313 #endif
314 
315 		type = "WM";
316 		break;
317 	case 2:
318 		type = "WA";
319 		break;
320 	default:
321 		type = "unknown";
322 		break;
323 	}
324 
325 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, len, data);
326 }
327 
328 static void
329 mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
330 {
331 	if (!vif->bss_conf.color_change_active)
332 		return;
333 
334 	ieee80211_color_change_finish(vif);
335 }
336 
337 static void
338 mt7915_mcu_rx_bcc_notify(struct mt7915_dev *dev, struct sk_buff *skb)
339 {
340 	struct mt76_phy *mphy = &dev->mt76.phy;
341 	struct mt7915_mcu_bcc_notify *b;
342 
343 	b = (struct mt7915_mcu_bcc_notify *)skb->data;
344 
345 	if (b->band_idx > MT_BAND1)
346 		return;
347 
348 	if ((b->band_idx && !dev->phy.mt76->band_idx) &&
349 	    dev->mt76.phys[MT_BAND1])
350 		mphy = dev->mt76.phys[MT_BAND1];
351 
352 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
353 			IEEE80211_IFACE_ITER_RESUME_ALL,
354 			mt7915_mcu_cca_finish, mphy->hw);
355 }
356 
357 static void
358 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
359 {
360 	struct mt76_connac2_mcu_rxd *rxd;
361 
362 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
363 	switch (rxd->ext_eid) {
364 	case MCU_EXT_EVENT_THERMAL_PROTECT:
365 		mt7915_mcu_rx_thermal_notify(dev, skb);
366 		break;
367 	case MCU_EXT_EVENT_RDD_REPORT:
368 		mt7915_mcu_rx_radar_detected(dev, skb);
369 		break;
370 	case MCU_EXT_EVENT_CSA_NOTIFY:
371 		mt7915_mcu_rx_csa_notify(dev, skb);
372 		break;
373 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
374 		mt7915_mcu_rx_log_message(dev, skb);
375 		break;
376 	case MCU_EXT_EVENT_BCC_NOTIFY:
377 		mt7915_mcu_rx_bcc_notify(dev, skb);
378 		break;
379 	default:
380 		break;
381 	}
382 }
383 
384 static void
385 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
386 {
387 	struct mt76_connac2_mcu_rxd *rxd;
388 
389 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
390 	switch (rxd->eid) {
391 	case MCU_EVENT_EXT:
392 		mt7915_mcu_rx_ext_event(dev, skb);
393 		break;
394 	default:
395 		break;
396 	}
397 	dev_kfree_skb(skb);
398 }
399 
400 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
401 {
402 	struct mt76_connac2_mcu_rxd *rxd;
403 
404 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
405 	if ((rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
406 	     rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
407 	     rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
408 	     rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
409 	     rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
410 	     !rxd->seq) &&
411 	     !(rxd->eid == MCU_CMD_EXT_CID &&
412 	       rxd->ext_eid == MCU_EXT_EVENT_WA_TX_STAT))
413 		mt7915_mcu_rx_unsolicited_event(dev, skb);
414 	else
415 		mt76_mcu_rx_event(&dev->mt76, skb);
416 }
417 
418 static struct tlv *
419 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
420 			     __le16 *sub_ntlv, __le16 *len)
421 {
422 	struct tlv *ptlv, tlv = {
423 		.tag = cpu_to_le16(sub_tag),
424 		.len = cpu_to_le16(sub_len),
425 	};
426 
427 	ptlv = skb_put(skb, sub_len);
428 	memcpy(ptlv, &tlv, sizeof(tlv));
429 
430 	le16_add_cpu(sub_ntlv, 1);
431 	le16_add_cpu(len, sub_len);
432 
433 	return ptlv;
434 }
435 
436 /** bss info **/
437 struct mt7915_he_obss_narrow_bw_ru_data {
438 	bool tolerated;
439 };
440 
441 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
442 						   struct cfg80211_bss *bss,
443 						   void *_data)
444 {
445 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
446 	const struct element *elem;
447 
448 	rcu_read_lock();
449 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
450 
451 	if (!elem || elem->datalen <= 10 ||
452 	    !(elem->data[10] &
453 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
454 		data->tolerated = false;
455 
456 	rcu_read_unlock();
457 }
458 
459 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
460 					      struct ieee80211_vif *vif)
461 {
462 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
463 		.tolerated = true,
464 	};
465 
466 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
467 		return false;
468 
469 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
470 			  mt7915_check_he_obss_narrow_bw_ru_iter,
471 			  &iter_data);
472 
473 	/*
474 	 * If there is at least one AP on radar channel that cannot
475 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
476 	 */
477 	return !iter_data.tolerated;
478 }
479 
480 static void
481 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
482 			struct mt7915_phy *phy)
483 {
484 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
485 	struct bss_info_rf_ch *ch;
486 	struct tlv *tlv;
487 	int freq1 = chandef->center_freq1;
488 
489 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
490 
491 	ch = (struct bss_info_rf_ch *)tlv;
492 	ch->pri_ch = chandef->chan->hw_value;
493 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
494 	ch->bw = mt76_connac_chan_bw(chandef);
495 
496 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
497 		int freq2 = chandef->center_freq2;
498 
499 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
500 	}
501 
502 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
503 		struct mt76_phy *mphy = phy->mt76;
504 
505 		ch->he_ru26_block =
506 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
507 		ch->he_all_disable = false;
508 	} else {
509 		ch->he_all_disable = true;
510 	}
511 }
512 
513 static void
514 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
515 		      struct mt7915_phy *phy)
516 {
517 	int max_nss = hweight8(phy->mt76->antenna_mask);
518 	struct bss_info_ra *ra;
519 	struct tlv *tlv;
520 
521 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
522 
523 	ra = (struct bss_info_ra *)tlv;
524 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
525 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
526 	ra->short_preamble = true;
527 	ra->tx_streams = max_nss;
528 	ra->rx_streams = max_nss;
529 	ra->algo = 4;
530 	ra->train_up_rule = 2;
531 	ra->train_up_high_thres = 110;
532 	ra->train_up_rule_rssi = -70;
533 	ra->low_traffic_thres = 2;
534 	ra->phy_cap = cpu_to_le32(0xfdf);
535 	ra->interval = cpu_to_le32(500);
536 	ra->fast_interval = cpu_to_le32(100);
537 }
538 
539 static void
540 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
541 		      struct mt7915_phy *phy)
542 {
543 #define DEFAULT_HE_PE_DURATION		4
544 #define DEFAULT_HE_DURATION_RTS_THRES	1023
545 	const struct ieee80211_sta_he_cap *cap;
546 	struct bss_info_he *he;
547 	struct tlv *tlv;
548 
549 	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
550 
551 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
552 
553 	he = (struct bss_info_he *)tlv;
554 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
555 	if (!he->he_pe_duration)
556 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
557 
558 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
559 	if (!he->he_rts_thres)
560 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
561 
562 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
563 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
564 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
565 }
566 
567 static void
568 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
569 {
570 #define TXD_CMP_MAP1		GENMASK(15, 0)
571 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
572 	struct bss_info_hw_amsdu *amsdu;
573 	struct tlv *tlv;
574 
575 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
576 
577 	amsdu = (struct bss_info_hw_amsdu *)tlv;
578 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
579 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
580 	amsdu->trig_thres = cpu_to_le16(2);
581 	amsdu->enable = true;
582 }
583 
584 static void
585 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
586 {
587 	struct bss_info_bmc_rate *bmc;
588 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
589 	enum nl80211_band band = chandef->chan->band;
590 	struct tlv *tlv;
591 
592 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
593 
594 	bmc = (struct bss_info_bmc_rate *)tlv;
595 	if (band == NL80211_BAND_2GHZ) {
596 		bmc->short_preamble = true;
597 	} else {
598 		bmc->bc_trans = cpu_to_le16(0x2000);
599 		bmc->mc_trans = cpu_to_le16(0x2080);
600 	}
601 }
602 
603 static int
604 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
605 		       bool bssid, bool enable)
606 {
607 	struct mt7915_dev *dev = phy->dev;
608 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
609 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
610 	u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
611 	const u8 *addr = vif->addr;
612 	struct {
613 		u8 mode;
614 		u8 force_clear;
615 		u8 clear_bitmap[8];
616 		u8 entry_count;
617 		u8 write;
618 		u8 band;
619 
620 		u8 index;
621 		u8 bssid;
622 		u8 addr[ETH_ALEN];
623 	} __packed req = {
624 		.mode = !!mask || enable,
625 		.entry_count = 1,
626 		.write = 1,
627 		.band = phy->mt76->band_idx,
628 		.index = idx * 2 + bssid,
629 	};
630 
631 	if (bssid)
632 		addr = vif->bss_conf.bssid;
633 
634 	if (enable)
635 		ether_addr_copy(req.addr, addr);
636 
637 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
638 				 sizeof(req), true);
639 }
640 
641 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
642 			    struct ieee80211_vif *vif, int enable)
643 {
644 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
645 	struct mt7915_dev *dev = phy->dev;
646 	struct sk_buff *skb;
647 
648 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
649 		mt7915_mcu_muar_config(phy, vif, false, enable);
650 		mt7915_mcu_muar_config(phy, vif, true, enable);
651 	}
652 
653 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
654 					      MT7915_BSS_UPDATE_MAX_SIZE);
655 	if (IS_ERR(skb))
656 		return PTR_ERR(skb);
657 
658 	/* bss_omac must be first */
659 	if (enable)
660 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
661 
662 	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
663 				      mvif->sta.wcid.idx, enable);
664 
665 	if (vif->type == NL80211_IFTYPE_MONITOR)
666 		goto out;
667 
668 	if (enable) {
669 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
670 		mt7915_mcu_bss_bmc_tlv(skb, phy);
671 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
672 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
673 
674 		if (vif->bss_conf.he_support)
675 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
676 
677 		if (mvif->mt76.omac_idx >= EXT_BSSID_START &&
678 		    mvif->mt76.omac_idx < REPEATER_BSSID_START)
679 			mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
680 	}
681 out:
682 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
683 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
684 }
685 
686 /** starec & wtbl **/
687 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
688 			 struct ieee80211_ampdu_params *params,
689 			 bool enable)
690 {
691 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
692 	struct mt7915_vif *mvif = msta->vif;
693 
694 	if (enable && !params->amsdu)
695 		msta->wcid.amsdu = false;
696 
697 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
698 				      MCU_EXT_CMD(STA_REC_UPDATE),
699 				      enable, true);
700 }
701 
702 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
703 			 struct ieee80211_ampdu_params *params,
704 			 bool enable)
705 {
706 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
707 	struct mt7915_vif *mvif = msta->vif;
708 
709 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
710 				      MCU_EXT_CMD(STA_REC_UPDATE),
711 				      enable, false);
712 }
713 
714 static void
715 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
716 		      struct ieee80211_vif *vif)
717 {
718 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
719 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
720 	struct ieee80211_he_mcs_nss_supp mcs_map;
721 	struct sta_rec_he *he;
722 	struct tlv *tlv;
723 	u32 cap = 0;
724 
725 	if (!sta->deflink.he_cap.has_he)
726 		return;
727 
728 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
729 
730 	he = (struct sta_rec_he *)tlv;
731 
732 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
733 		cap |= STA_REC_HE_CAP_HTC;
734 
735 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
736 		cap |= STA_REC_HE_CAP_BSR;
737 
738 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
739 		cap |= STA_REC_HE_CAP_OM;
740 
741 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
742 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
743 
744 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
745 		cap |= STA_REC_HE_CAP_BQR;
746 
747 	if (elem->phy_cap_info[0] &
748 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
749 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
750 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
751 
752 	if (mvif->cap.he_ldpc &&
753 	    (elem->phy_cap_info[1] &
754 	     IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
755 		cap |= STA_REC_HE_CAP_LDPC;
756 
757 	if (elem->phy_cap_info[1] &
758 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
759 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
760 
761 	if (elem->phy_cap_info[2] &
762 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
763 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
764 
765 	if (elem->phy_cap_info[2] &
766 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
767 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
768 
769 	if (elem->phy_cap_info[2] &
770 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
771 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
772 
773 	if (elem->phy_cap_info[6] &
774 	    IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB)
775 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
776 
777 	if (elem->phy_cap_info[6] &
778 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
779 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
780 
781 	if (elem->phy_cap_info[7] &
782 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
783 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
784 
785 	if (elem->phy_cap_info[7] &
786 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
787 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
788 
789 	if (elem->phy_cap_info[7] &
790 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
791 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
792 
793 	if (elem->phy_cap_info[8] &
794 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
795 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
796 
797 	if (elem->phy_cap_info[8] &
798 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
799 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
800 
801 	if (elem->phy_cap_info[9] &
802 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
803 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
804 
805 	if (elem->phy_cap_info[9] &
806 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
807 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
808 
809 	he->he_cap = cpu_to_le32(cap);
810 
811 	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
812 	switch (sta->deflink.bandwidth) {
813 	case IEEE80211_STA_RX_BW_160:
814 		if (elem->phy_cap_info[0] &
815 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
816 			mt7915_mcu_set_sta_he_mcs(sta,
817 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
818 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
819 
820 		mt7915_mcu_set_sta_he_mcs(sta,
821 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
822 					  le16_to_cpu(mcs_map.rx_mcs_160));
823 		fallthrough;
824 	default:
825 		mt7915_mcu_set_sta_he_mcs(sta,
826 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
827 					  le16_to_cpu(mcs_map.rx_mcs_80));
828 		break;
829 	}
830 
831 	he->t_frame_dur =
832 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
833 	he->max_ampdu_exp =
834 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
835 
836 	he->bw_set =
837 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
838 	he->device_class =
839 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
840 	he->punc_pream_rx =
841 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
842 
843 	he->dcm_tx_mode =
844 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
845 	he->dcm_tx_max_nss =
846 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
847 	he->dcm_rx_mode =
848 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
849 	he->dcm_rx_max_nss =
850 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
851 	he->dcm_rx_max_nss =
852 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
853 
854 	he->pkt_ext = 2;
855 }
856 
857 static void
858 mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
859 			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
860 {
861 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
862 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
863 	struct sta_rec_muru *muru;
864 	struct tlv *tlv;
865 
866 	if (vif->type != NL80211_IFTYPE_STATION &&
867 	    vif->type != NL80211_IFTYPE_AP)
868 		return;
869 
870 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
871 
872 	muru = (struct sta_rec_muru *)tlv;
873 
874 	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
875 			       mvif->cap.vht_mu_ebfer ||
876 			       mvif->cap.vht_mu_ebfee;
877 	if (!is_mt7915(&dev->mt76))
878 		muru->cfg.mimo_ul_en = true;
879 	muru->cfg.ofdma_dl_en = true;
880 
881 	if (sta->deflink.vht_cap.vht_supported)
882 		muru->mimo_dl.vht_mu_bfee =
883 			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
884 
885 	if (!sta->deflink.he_cap.has_he)
886 		return;
887 
888 	muru->mimo_dl.partial_bw_dl_mimo =
889 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
890 
891 	muru->mimo_ul.full_ul_mimo =
892 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
893 	muru->mimo_ul.partial_ul_mimo =
894 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
895 
896 	muru->ofdma_dl.punc_pream_rx =
897 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
898 	muru->ofdma_dl.he_20m_in_40m_2g =
899 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
900 	muru->ofdma_dl.he_20m_in_160m =
901 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
902 	muru->ofdma_dl.he_80m_in_160m =
903 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
904 
905 	muru->ofdma_ul.t_frame_dur =
906 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
907 	muru->ofdma_ul.mu_cascading =
908 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
909 	muru->ofdma_ul.uo_ra =
910 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
911 }
912 
913 static void
914 mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
915 {
916 	struct sta_rec_ht *ht;
917 	struct tlv *tlv;
918 
919 	if (!sta->deflink.ht_cap.ht_supported)
920 		return;
921 
922 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
923 
924 	ht = (struct sta_rec_ht *)tlv;
925 	ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
926 }
927 
928 static void
929 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
930 {
931 	struct sta_rec_vht *vht;
932 	struct tlv *tlv;
933 
934 	if (!sta->deflink.vht_cap.vht_supported)
935 		return;
936 
937 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
938 
939 	vht = (struct sta_rec_vht *)tlv;
940 	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
941 	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
942 	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
943 }
944 
945 static void
946 mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
947 			 struct ieee80211_vif *vif, struct ieee80211_sta *sta)
948 {
949 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
950 	struct sta_rec_amsdu *amsdu;
951 	struct tlv *tlv;
952 
953 	if (vif->type != NL80211_IFTYPE_STATION &&
954 	    vif->type != NL80211_IFTYPE_AP)
955 		return;
956 
957 	if (!sta->deflink.agg.max_amsdu_len)
958 	    return;
959 
960 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
961 	amsdu = (struct sta_rec_amsdu *)tlv;
962 	amsdu->max_amsdu_num = 8;
963 	amsdu->amsdu_en = true;
964 	msta->wcid.amsdu = true;
965 
966 	switch (sta->deflink.agg.max_amsdu_len) {
967 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
968 		if (!is_mt7915(&dev->mt76)) {
969 			amsdu->max_mpdu_size =
970 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
971 			return;
972 		}
973 		fallthrough;
974 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
975 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
976 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
977 		return;
978 	default:
979 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
980 		return;
981 	}
982 }
983 
984 static int
985 mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
986 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
987 {
988 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
989 	struct mt7915_sta *msta;
990 	struct wtbl_req_hdr *wtbl_hdr;
991 	struct mt76_wcid *wcid;
992 	struct tlv *tlv;
993 
994 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
995 	wcid = sta ? &msta->wcid : NULL;
996 
997 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
998 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
999 						  WTBL_RESET_AND_SET, tlv,
1000 						  &skb);
1001 	if (IS_ERR(wtbl_hdr))
1002 		return PTR_ERR(wtbl_hdr);
1003 
1004 	mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, skb, vif, sta, tlv,
1005 					 wtbl_hdr);
1006 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, tlv, wtbl_hdr);
1007 	if (sta)
1008 		mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, skb, sta, tlv,
1009 					    wtbl_hdr, mvif->cap.ht_ldpc,
1010 					    mvif->cap.vht_ldpc);
1011 
1012 	return 0;
1013 }
1014 
1015 static inline bool
1016 mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1017 			struct ieee80211_sta *sta, bool bfee)
1018 {
1019 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1020 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1021 
1022 	if (vif->type != NL80211_IFTYPE_STATION &&
1023 	    vif->type != NL80211_IFTYPE_AP)
1024 		return false;
1025 
1026 	if (!bfee && tx_ant < 2)
1027 		return false;
1028 
1029 	if (sta->deflink.he_cap.has_he) {
1030 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1031 
1032 		if (bfee)
1033 			return mvif->cap.he_su_ebfee &&
1034 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1035 		else
1036 			return mvif->cap.he_su_ebfer &&
1037 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1038 	}
1039 
1040 	if (sta->deflink.vht_cap.vht_supported) {
1041 		u32 cap = sta->deflink.vht_cap.cap;
1042 
1043 		if (bfee)
1044 			return mvif->cap.vht_su_ebfee &&
1045 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1046 		else
1047 			return mvif->cap.vht_su_ebfer &&
1048 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1049 	}
1050 
1051 	return false;
1052 }
1053 
1054 static void
1055 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1056 {
1057 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1058 	bf->ndp_rate = 0;				/* mcs0 */
1059 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1060 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1061 }
1062 
1063 static void
1064 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1065 		       struct sta_rec_bf *bf)
1066 {
1067 	struct ieee80211_mcs_info *mcs = &sta->deflink.ht_cap.mcs;
1068 	u8 n = 0;
1069 
1070 	bf->tx_mode = MT_PHY_TYPE_HT;
1071 
1072 	if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1073 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1074 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1075 			      mcs->tx_params);
1076 	else if (mcs->rx_mask[3])
1077 		n = 3;
1078 	else if (mcs->rx_mask[2])
1079 		n = 2;
1080 	else if (mcs->rx_mask[1])
1081 		n = 1;
1082 
1083 	bf->nrow = hweight8(phy->mt76->chainmask) - 1;
1084 	bf->ncol = min_t(u8, bf->nrow, n);
1085 	bf->ibf_ncol = n;
1086 }
1087 
1088 static void
1089 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1090 			struct sta_rec_bf *bf, bool explicit)
1091 {
1092 	struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1093 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1094 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1095 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1096 	u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1097 
1098 	bf->tx_mode = MT_PHY_TYPE_VHT;
1099 
1100 	if (explicit) {
1101 		u8 sts, snd_dim;
1102 
1103 		mt7915_mcu_sta_sounding_rate(bf);
1104 
1105 		sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1106 				pc->cap);
1107 		snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1108 				    vc->cap);
1109 		bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1110 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1111 		bf->ibf_ncol = bf->ncol;
1112 
1113 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1114 			bf->nrow = 1;
1115 	} else {
1116 		bf->nrow = tx_ant;
1117 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1118 		bf->ibf_ncol = nss_mcs;
1119 
1120 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1121 			bf->ibf_nrow = 1;
1122 	}
1123 }
1124 
1125 static void
1126 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1127 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1128 {
1129 	struct ieee80211_sta_he_cap *pc = &sta->deflink.he_cap;
1130 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1131 	const struct ieee80211_sta_he_cap *vc =
1132 		mt76_connac_get_he_phy_cap(phy->mt76, vif);
1133 	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1134 	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1135 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1136 	u8 snd_dim, sts;
1137 
1138 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1139 
1140 	mt7915_mcu_sta_sounding_rate(bf);
1141 
1142 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1143 				pe->phy_cap_info[6]);
1144 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1145 				pe->phy_cap_info[6]);
1146 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1147 			 ve->phy_cap_info[5]);
1148 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1149 		     pe->phy_cap_info[4]);
1150 	bf->nrow = min_t(u8, snd_dim, sts);
1151 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1152 	bf->ibf_ncol = bf->ncol;
1153 
1154 	if (sta->deflink.bandwidth != IEEE80211_STA_RX_BW_160)
1155 		return;
1156 
1157 	/* go over for 160MHz and 80p80 */
1158 	if (pe->phy_cap_info[0] &
1159 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1160 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1161 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1162 
1163 		bf->ncol_gt_bw80 = nss_mcs;
1164 	}
1165 
1166 	if (pe->phy_cap_info[0] &
1167 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1168 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1169 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1170 
1171 		if (bf->ncol_gt_bw80)
1172 			bf->ncol_gt_bw80 = min_t(u8, bf->ncol_gt_bw80, nss_mcs);
1173 		else
1174 			bf->ncol_gt_bw80 = nss_mcs;
1175 	}
1176 
1177 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1178 			 ve->phy_cap_info[5]);
1179 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1180 		     pe->phy_cap_info[4]);
1181 
1182 	bf->nrow_gt_bw80 = min_t(int, snd_dim, sts);
1183 }
1184 
1185 static void
1186 mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1187 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1188 {
1189 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1190 	struct mt7915_phy *phy = mvif->phy;
1191 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1192 	struct sta_rec_bf *bf;
1193 	struct tlv *tlv;
1194 	const u8 matrix[4][4] = {
1195 		{0, 0, 0, 0},
1196 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1197 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1198 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1199 	};
1200 	bool ebf;
1201 
1202 	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
1203 		return;
1204 
1205 	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
1206 	if (!ebf && !dev->ibf)
1207 		return;
1208 
1209 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1210 	bf = (struct sta_rec_bf *)tlv;
1211 
1212 	/* he: eBF only, in accordance with spec
1213 	 * vht: support eBF and iBF
1214 	 * ht: iBF only, since mac80211 lacks of eBF support
1215 	 */
1216 	if (sta->deflink.he_cap.has_he && ebf)
1217 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1218 	else if (sta->deflink.vht_cap.vht_supported)
1219 		mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
1220 	else if (sta->deflink.ht_cap.ht_supported)
1221 		mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1222 	else
1223 		return;
1224 
1225 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
1226 	bf->bw = sta->deflink.bandwidth;
1227 	bf->ibf_dbw = sta->deflink.bandwidth;
1228 	bf->ibf_nrow = tx_ant;
1229 
1230 	if (!ebf && sta->deflink.bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1231 		bf->ibf_timeout = 0x48;
1232 	else
1233 		bf->ibf_timeout = 0x18;
1234 
1235 	if (ebf && bf->nrow != tx_ant)
1236 		bf->mem_20m = matrix[tx_ant][bf->ncol];
1237 	else
1238 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
1239 
1240 	switch (sta->deflink.bandwidth) {
1241 	case IEEE80211_STA_RX_BW_160:
1242 	case IEEE80211_STA_RX_BW_80:
1243 		bf->mem_total = bf->mem_20m * 2;
1244 		break;
1245 	case IEEE80211_STA_RX_BW_40:
1246 		bf->mem_total = bf->mem_20m;
1247 		break;
1248 	case IEEE80211_STA_RX_BW_20:
1249 	default:
1250 		break;
1251 	}
1252 }
1253 
1254 static void
1255 mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1256 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1257 {
1258 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1259 	struct mt7915_phy *phy = mvif->phy;
1260 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1261 	struct sta_rec_bfee *bfee;
1262 	struct tlv *tlv;
1263 	u8 nrow = 0;
1264 
1265 	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
1266 		return;
1267 
1268 	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
1269 		return;
1270 
1271 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1272 	bfee = (struct sta_rec_bfee *)tlv;
1273 
1274 	if (sta->deflink.he_cap.has_he) {
1275 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1276 
1277 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1278 			      pe->phy_cap_info[5]);
1279 	} else if (sta->deflink.vht_cap.vht_supported) {
1280 		struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1281 
1282 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1283 				 pc->cap);
1284 	}
1285 
1286 	/* reply with identity matrix to avoid 2x2 BF negative gain */
1287 	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
1288 }
1289 
1290 static enum mcu_mmps_mode
1291 mt7915_mcu_get_mmps_mode(enum ieee80211_smps_mode smps)
1292 {
1293 	switch (smps) {
1294 	case IEEE80211_SMPS_OFF:
1295 		return MCU_MMPS_DISABLE;
1296 	case IEEE80211_SMPS_STATIC:
1297 		return MCU_MMPS_STATIC;
1298 	case IEEE80211_SMPS_DYNAMIC:
1299 		return MCU_MMPS_DYNAMIC;
1300 	default:
1301 		return MCU_MMPS_DISABLE;
1302 	}
1303 }
1304 
1305 int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
1306 				   struct ieee80211_vif *vif,
1307 				   struct ieee80211_sta *sta,
1308 				   void *data, u32 field)
1309 {
1310 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1311 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1312 	struct sta_phy *phy = data;
1313 	struct sta_rec_ra_fixed *ra;
1314 	struct sk_buff *skb;
1315 	struct tlv *tlv;
1316 
1317 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1318 					    &msta->wcid);
1319 	if (IS_ERR(skb))
1320 		return PTR_ERR(skb);
1321 
1322 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
1323 	ra = (struct sta_rec_ra_fixed *)tlv;
1324 
1325 	switch (field) {
1326 	case RATE_PARAM_AUTO:
1327 		break;
1328 	case RATE_PARAM_FIXED:
1329 	case RATE_PARAM_FIXED_MCS:
1330 	case RATE_PARAM_FIXED_GI:
1331 	case RATE_PARAM_FIXED_HE_LTF:
1332 		if (phy)
1333 			ra->phy = *phy;
1334 		break;
1335 	case RATE_PARAM_MMPS_UPDATE:
1336 		ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1337 		break;
1338 	case RATE_PARAM_SPE_UPDATE:
1339 		ra->spe_idx = *(u8 *)data;
1340 		break;
1341 	default:
1342 		break;
1343 	}
1344 	ra->field = cpu_to_le32(field);
1345 
1346 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1347 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1348 }
1349 
1350 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1351 			struct ieee80211_sta *sta)
1352 {
1353 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1354 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1355 	struct wtbl_req_hdr *wtbl_hdr;
1356 	struct tlv *sta_wtbl;
1357 	struct sk_buff *skb;
1358 	int ret;
1359 
1360 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1361 					    &msta->wcid);
1362 	if (IS_ERR(skb))
1363 		return PTR_ERR(skb);
1364 
1365 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1366 					   sizeof(struct tlv));
1367 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1368 						  WTBL_SET, sta_wtbl, &skb);
1369 	if (IS_ERR(wtbl_hdr))
1370 		return PTR_ERR(wtbl_hdr);
1371 
1372 	mt76_connac_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1373 
1374 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1375 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1376 	if (ret)
1377 		return ret;
1378 
1379 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, NULL,
1380 					      RATE_PARAM_MMPS_UPDATE);
1381 }
1382 
1383 static int
1384 mt7915_mcu_set_spe_idx(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1385 		       struct ieee80211_sta *sta)
1386 {
1387 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1388 	struct mt76_phy *mphy = mvif->phy->mt76;
1389 	u8 spe_idx = mt76_connac_spe_idx(mphy->antenna_mask);
1390 
1391 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &spe_idx,
1392 					      RATE_PARAM_SPE_UPDATE);
1393 }
1394 
1395 static int
1396 mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
1397 			       struct ieee80211_vif *vif,
1398 			       struct ieee80211_sta *sta)
1399 {
1400 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1401 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1402 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1403 	enum nl80211_band band = chandef->chan->band;
1404 	struct sta_phy phy = {};
1405 	int ret, nrates = 0;
1406 
1407 #define __sta_phy_bitrate_mask_check(_mcs, _gi, _ht, _he)			\
1408 	do {									\
1409 		u8 i, gi = mask->control[band]._gi;				\
1410 		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
1411 		for (i = 0; i <= sta->deflink.bandwidth; i++) {			\
1412 			phy.sgi |= gi << (i << (_he));				\
1413 			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
1414 		}								\
1415 		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {	\
1416 			if (!mask->control[band]._mcs[i])			\
1417 				continue;					\
1418 			nrates += hweight16(mask->control[band]._mcs[i]);	\
1419 			phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;		\
1420 			if (_ht)						\
1421 				phy.mcs += 8 * i;				\
1422 		}								\
1423 	} while (0)
1424 
1425 	if (sta->deflink.he_cap.has_he) {
1426 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
1427 	} else if (sta->deflink.vht_cap.vht_supported) {
1428 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
1429 	} else if (sta->deflink.ht_cap.ht_supported) {
1430 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
1431 	} else {
1432 		nrates = hweight32(mask->control[band].legacy);
1433 		phy.mcs = ffs(mask->control[band].legacy) - 1;
1434 	}
1435 #undef __sta_phy_bitrate_mask_check
1436 
1437 	/* fall back to auto rate control */
1438 	if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
1439 	    mask->control[band].he_gi == GENMASK(7, 0) &&
1440 	    mask->control[band].he_ltf == GENMASK(7, 0) &&
1441 	    nrates != 1)
1442 		return 0;
1443 
1444 	/* fixed single rate */
1445 	if (nrates == 1) {
1446 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1447 						     RATE_PARAM_FIXED_MCS);
1448 		if (ret)
1449 			return ret;
1450 	}
1451 
1452 	/* fixed GI */
1453 	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
1454 	    mask->control[band].he_gi != GENMASK(7, 0)) {
1455 		struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1456 		u32 addr;
1457 
1458 		/* firmware updates only TXCMD but doesn't take WTBL into
1459 		 * account, so driver should update here to reflect the
1460 		 * actual txrate hardware sends out.
1461 		 */
1462 		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
1463 		if (sta->deflink.he_cap.has_he)
1464 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
1465 		else
1466 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
1467 
1468 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1469 						     RATE_PARAM_FIXED_GI);
1470 		if (ret)
1471 			return ret;
1472 	}
1473 
1474 	/* fixed HE_LTF */
1475 	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
1476 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1477 						     RATE_PARAM_FIXED_HE_LTF);
1478 		if (ret)
1479 			return ret;
1480 	}
1481 
1482 	return mt7915_mcu_set_spe_idx(dev, vif, sta);
1483 }
1484 
1485 static void
1486 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
1487 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1488 {
1489 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1490 	struct mt76_phy *mphy = mvif->phy->mt76;
1491 	struct cfg80211_chan_def *chandef = &mphy->chandef;
1492 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1493 	enum nl80211_band band = chandef->chan->band;
1494 	struct sta_rec_ra *ra;
1495 	struct tlv *tlv;
1496 	u32 supp_rate = sta->deflink.supp_rates[band];
1497 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
1498 
1499 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
1500 	ra = (struct sta_rec_ra *)tlv;
1501 
1502 	ra->valid = true;
1503 	ra->auto_rate = true;
1504 	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
1505 	ra->channel = chandef->chan->hw_value;
1506 	ra->bw = sta->deflink.bandwidth;
1507 	ra->phy.bw = sta->deflink.bandwidth;
1508 	ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1509 
1510 	if (supp_rate) {
1511 		supp_rate &= mask->control[band].legacy;
1512 		ra->rate_len = hweight32(supp_rate);
1513 
1514 		if (band == NL80211_BAND_2GHZ) {
1515 			ra->supp_mode = MODE_CCK;
1516 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
1517 
1518 			if (ra->rate_len > 4) {
1519 				ra->supp_mode |= MODE_OFDM;
1520 				ra->supp_ofdm_rate = supp_rate >> 4;
1521 			}
1522 		} else {
1523 			ra->supp_mode = MODE_OFDM;
1524 			ra->supp_ofdm_rate = supp_rate;
1525 		}
1526 	}
1527 
1528 	if (sta->deflink.ht_cap.ht_supported) {
1529 		ra->supp_mode |= MODE_HT;
1530 		ra->af = sta->deflink.ht_cap.ampdu_factor;
1531 		ra->ht_gf = !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
1532 
1533 		cap |= STA_CAP_HT;
1534 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1535 			cap |= STA_CAP_SGI_20;
1536 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1537 			cap |= STA_CAP_SGI_40;
1538 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
1539 			cap |= STA_CAP_TX_STBC;
1540 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
1541 			cap |= STA_CAP_RX_STBC;
1542 		if (mvif->cap.ht_ldpc &&
1543 		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
1544 			cap |= STA_CAP_LDPC;
1545 
1546 		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
1547 					  mask->control[band].ht_mcs);
1548 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
1549 	}
1550 
1551 	if (sta->deflink.vht_cap.vht_supported) {
1552 		u8 af;
1553 
1554 		ra->supp_mode |= MODE_VHT;
1555 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1556 			       sta->deflink.vht_cap.cap);
1557 		ra->af = max_t(u8, ra->af, af);
1558 
1559 		cap |= STA_CAP_VHT;
1560 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1561 			cap |= STA_CAP_VHT_SGI_80;
1562 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1563 			cap |= STA_CAP_VHT_SGI_160;
1564 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
1565 			cap |= STA_CAP_VHT_TX_STBC;
1566 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
1567 			cap |= STA_CAP_VHT_RX_STBC;
1568 		if (mvif->cap.vht_ldpc &&
1569 		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
1570 			cap |= STA_CAP_VHT_LDPC;
1571 
1572 		mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
1573 					   mask->control[band].vht_mcs);
1574 	}
1575 
1576 	if (sta->deflink.he_cap.has_he) {
1577 		ra->supp_mode |= MODE_HE;
1578 		cap |= STA_CAP_HE;
1579 
1580 		if (sta->deflink.he_6ghz_capa.capa)
1581 			ra->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
1582 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1583 	}
1584 
1585 	ra->sta_cap = cpu_to_le32(cap);
1586 }
1587 
1588 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1589 			     struct ieee80211_sta *sta, bool changed)
1590 {
1591 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1592 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1593 	struct sk_buff *skb;
1594 	int ret;
1595 
1596 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1597 					    &msta->wcid);
1598 	if (IS_ERR(skb))
1599 		return PTR_ERR(skb);
1600 
1601 	/* firmware rc algorithm refers to sta_rec_he for HE control.
1602 	 * once dev->rc_work changes the settings driver should also
1603 	 * update sta_rec_he here.
1604 	 */
1605 	if (changed)
1606 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1607 
1608 	/* sta_rec_ra accommodates BW, NSS and only MCS range format
1609 	 * i.e 0-{7,8,9} for VHT.
1610 	 */
1611 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
1612 
1613 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1614 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1615 	if (ret)
1616 		return ret;
1617 
1618 	/* sta_rec_ra_fixed accommodates single rate, (HE)GI and HE_LTE,
1619 	 * and updates as peer fixed rate parameters, which overrides
1620 	 * sta_rec_ra and firmware rate control algorithm.
1621 	 */
1622 	return mt7915_mcu_add_rate_ctrl_fixed(dev, vif, sta);
1623 }
1624 
1625 static int
1626 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1627 		     struct ieee80211_sta *sta)
1628 {
1629 #define MT_STA_BSS_GROUP		1
1630 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1631 	struct mt7915_sta *msta;
1632 	struct {
1633 		__le32 action;
1634 		u8 wlan_idx_lo;
1635 		u8 status;
1636 		u8 wlan_idx_hi;
1637 		u8 rsv0[5];
1638 		__le32 val;
1639 		u8 rsv1[8];
1640 	} __packed req = {
1641 		.action = cpu_to_le32(MT_STA_BSS_GROUP),
1642 		.val = cpu_to_le32(mvif->mt76.idx % 16),
1643 	};
1644 
1645 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1646 	req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
1647 	req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
1648 
1649 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
1650 				 sizeof(req), true);
1651 }
1652 
1653 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1654 		       struct ieee80211_sta *sta, bool enable)
1655 {
1656 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1657 	struct mt7915_sta *msta;
1658 	struct sk_buff *skb;
1659 	int ret;
1660 
1661 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1662 
1663 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1664 					    &msta->wcid);
1665 	if (IS_ERR(skb))
1666 		return PTR_ERR(skb);
1667 
1668 	/* starec basic */
1669 	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, sta, enable,
1670 				      !rcu_access_pointer(dev->mt76.wcid[msta->wcid.idx]));
1671 	if (!enable)
1672 		goto out;
1673 
1674 	/* tag order is in accordance with firmware dependency. */
1675 	if (sta) {
1676 		/* starec bfer */
1677 		mt7915_mcu_sta_bfer_tlv(dev, skb, vif, sta);
1678 		/* starec ht */
1679 		mt7915_mcu_sta_ht_tlv(skb, sta);
1680 		/* starec vht */
1681 		mt7915_mcu_sta_vht_tlv(skb, sta);
1682 		/* starec uapsd */
1683 		mt76_connac_mcu_sta_uapsd(skb, vif, sta);
1684 	}
1685 
1686 	ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
1687 	if (ret) {
1688 		dev_kfree_skb(skb);
1689 		return ret;
1690 	}
1691 
1692 	if (sta) {
1693 		/* starec amsdu */
1694 		mt7915_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
1695 		/* starec he */
1696 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1697 		/* starec muru */
1698 		mt7915_mcu_sta_muru_tlv(dev, skb, sta, vif);
1699 		/* starec bfee */
1700 		mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
1701 	}
1702 
1703 	ret = mt7915_mcu_add_group(dev, vif, sta);
1704 	if (ret) {
1705 		dev_kfree_skb(skb);
1706 		return ret;
1707 	}
1708 out:
1709 	ret = mt76_connac_mcu_sta_wed_update(&dev->mt76, skb);
1710 	if (ret)
1711 		return ret;
1712 
1713 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1714 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1715 }
1716 
1717 int mt7915_mcu_wed_enable_rx_stats(struct mt7915_dev *dev)
1718 {
1719 #ifdef CONFIG_NET_MEDIATEK_SOC_WED
1720 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
1721 	struct {
1722 		__le32 args[2];
1723 	} req = {
1724 		.args[0] = cpu_to_le32(1),
1725 		.args[1] = cpu_to_le32(6),
1726 	};
1727 
1728 	return mtk_wed_device_update_msg(wed, MTK_WED_WO_CMD_RXCNT_CTRL,
1729 					 &req, sizeof(req));
1730 #else
1731 	return 0;
1732 #endif
1733 }
1734 
1735 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
1736 			    struct ieee80211_vif *vif, bool enable)
1737 {
1738 	struct mt7915_dev *dev = phy->dev;
1739 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1740 	struct {
1741 		struct req_hdr {
1742 			u8 omac_idx;
1743 			u8 band_idx;
1744 			__le16 tlv_num;
1745 			u8 is_tlv_append;
1746 			u8 rsv[3];
1747 		} __packed hdr;
1748 		struct req_tlv {
1749 			__le16 tag;
1750 			__le16 len;
1751 			u8 active;
1752 			u8 band_idx;
1753 			u8 omac_addr[ETH_ALEN];
1754 		} __packed tlv;
1755 	} data = {
1756 		.hdr = {
1757 			.omac_idx = mvif->mt76.omac_idx,
1758 			.band_idx = mvif->mt76.band_idx,
1759 			.tlv_num = cpu_to_le16(1),
1760 			.is_tlv_append = 1,
1761 		},
1762 		.tlv = {
1763 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
1764 			.len = cpu_to_le16(sizeof(struct req_tlv)),
1765 			.active = enable,
1766 			.band_idx = mvif->mt76.band_idx,
1767 		},
1768 	};
1769 
1770 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
1771 		return mt7915_mcu_muar_config(phy, vif, false, enable);
1772 
1773 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
1774 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
1775 				 &data, sizeof(data), true);
1776 }
1777 
1778 static void
1779 mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
1780 			 struct sk_buff *skb, struct bss_info_bcn *bcn,
1781 			 struct ieee80211_mutable_offsets *offs)
1782 {
1783 	struct bss_info_bcn_cntdwn *info;
1784 	struct tlv *tlv;
1785 	int sub_tag;
1786 
1787 	if (!offs->cntdwn_counter_offs[0])
1788 		return;
1789 
1790 	sub_tag = vif->bss_conf.csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
1791 	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
1792 					   &bcn->sub_ntlv, &bcn->len);
1793 	info = (struct bss_info_bcn_cntdwn *)tlv;
1794 	info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
1795 }
1796 
1797 static void
1798 mt7915_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
1799 		       struct ieee80211_vif *vif, struct bss_info_bcn *bcn,
1800 		       struct ieee80211_mutable_offsets *offs)
1801 {
1802 	struct bss_info_bcn_mbss *mbss;
1803 	const struct element *elem;
1804 	struct tlv *tlv;
1805 
1806 	if (!vif->bss_conf.bssid_indicator)
1807 		return;
1808 
1809 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_MBSSID,
1810 					   sizeof(*mbss), &bcn->sub_ntlv,
1811 					   &bcn->len);
1812 
1813 	mbss = (struct bss_info_bcn_mbss *)tlv;
1814 	mbss->offset[0] = cpu_to_le16(offs->tim_offset);
1815 	mbss->bitmap = cpu_to_le32(1);
1816 
1817 	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
1818 			    &skb->data[offs->mbssid_off],
1819 			    skb->len - offs->mbssid_off) {
1820 		const struct element *sub_elem;
1821 
1822 		if (elem->datalen < 2)
1823 			continue;
1824 
1825 		for_each_element(sub_elem, elem->data + 1, elem->datalen - 1) {
1826 			const struct ieee80211_bssid_index *idx;
1827 			const u8 *idx_ie;
1828 
1829 			if (sub_elem->id || sub_elem->datalen < 4)
1830 				continue; /* not a valid BSS profile */
1831 
1832 			/* Find WLAN_EID_MULTI_BSSID_IDX
1833 			 * in the merged nontransmitted profile
1834 			 */
1835 			idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
1836 						  sub_elem->data,
1837 						  sub_elem->datalen);
1838 			if (!idx_ie || idx_ie[1] < sizeof(*idx))
1839 				continue;
1840 
1841 #if defined(__linux__)
1842 			idx = (void *)(idx_ie + 2);
1843 #elif defined(__FreeBSD__)
1844 			idx = (const void *)(idx_ie + 2);
1845 #endif
1846 			if (!idx->bssid_index || idx->bssid_index > 31)
1847 				continue;
1848 
1849 			mbss->offset[idx->bssid_index] =
1850 				cpu_to_le16(idx_ie - skb->data);
1851 			mbss->bitmap |= cpu_to_le32(BIT(idx->bssid_index));
1852 		}
1853 	}
1854 }
1855 
1856 static void
1857 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1858 		       struct sk_buff *rskb, struct sk_buff *skb,
1859 		       struct bss_info_bcn *bcn,
1860 		       struct ieee80211_mutable_offsets *offs)
1861 {
1862 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1863 	struct bss_info_bcn_cont *cont;
1864 	struct tlv *tlv;
1865 	u8 *buf;
1866 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
1867 
1868 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1869 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
1870 					   len, &bcn->sub_ntlv, &bcn->len);
1871 
1872 	cont = (struct bss_info_bcn_cont *)tlv;
1873 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1874 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
1875 
1876 	if (offs->cntdwn_counter_offs[0]) {
1877 		u16 offset = offs->cntdwn_counter_offs[0];
1878 
1879 		if (vif->bss_conf.csa_active)
1880 			cont->csa_ofs = cpu_to_le16(offset - 4);
1881 		if (vif->bss_conf.color_change_active)
1882 			cont->bcc_ofs = cpu_to_le16(offset - 3);
1883 	}
1884 
1885 	buf = (u8 *)tlv + sizeof(*cont);
1886 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
1887 			      0, BSS_CHANGED_BEACON);
1888 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1889 }
1890 
1891 static void
1892 mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1893 				struct sk_buff *rskb, struct bss_info_bcn *bcn,
1894 				u32 changed)
1895 {
1896 #define OFFLOAD_TX_MODE_SU	BIT(0)
1897 #define OFFLOAD_TX_MODE_MU	BIT(1)
1898 	struct ieee80211_hw *hw = mt76_hw(dev);
1899 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1900 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1901 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1902 	enum nl80211_band band = chandef->chan->band;
1903 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1904 	struct bss_info_inband_discovery *discov;
1905 	struct ieee80211_tx_info *info;
1906 	struct sk_buff *skb = NULL;
1907 	struct tlv *tlv;
1908 	bool ext_phy = phy != &dev->phy;
1909 	u8 *buf, interval;
1910 	int len;
1911 
1912 	if (changed & BSS_CHANGED_FILS_DISCOVERY &&
1913 	    vif->bss_conf.fils_discovery.max_interval) {
1914 		interval = vif->bss_conf.fils_discovery.max_interval;
1915 		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
1916 	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
1917 		   vif->bss_conf.unsol_bcast_probe_resp_interval) {
1918 		interval = vif->bss_conf.unsol_bcast_probe_resp_interval;
1919 		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
1920 	}
1921 
1922 	if (!skb)
1923 		return;
1924 
1925 	info = IEEE80211_SKB_CB(skb);
1926 	info->control.vif = vif;
1927 	info->band = band;
1928 
1929 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
1930 
1931 	len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
1932 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1933 
1934 	if (len > (MT7915_MAX_BSS_OFFLOAD_SIZE - rskb->len)) {
1935 		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
1936 		dev_kfree_skb(skb);
1937 		return;
1938 	}
1939 
1940 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_DISCOV,
1941 					   len, &bcn->sub_ntlv, &bcn->len);
1942 	discov = (struct bss_info_inband_discovery *)tlv;
1943 	discov->tx_mode = OFFLOAD_TX_MODE_SU;
1944 	/* 0: UNSOL PROBE RESP, 1: FILS DISCOV */
1945 	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
1946 	discov->tx_interval = interval;
1947 	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1948 	discov->enable = true;
1949 
1950 	buf = (u8 *)tlv + sizeof(*discov);
1951 
1952 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
1953 			      0, changed);
1954 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1955 
1956 	dev_kfree_skb(skb);
1957 }
1958 
1959 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1960 			  int en, u32 changed)
1961 {
1962 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
1963 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1964 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1965 	struct ieee80211_mutable_offsets offs;
1966 	struct ieee80211_tx_info *info;
1967 	struct sk_buff *skb, *rskb;
1968 	struct tlv *tlv;
1969 	struct bss_info_bcn *bcn;
1970 	int len = MT7915_MAX_BSS_OFFLOAD_SIZE;
1971 	bool ext_phy = phy != &dev->phy;
1972 
1973 	if (vif->bss_conf.nontransmitted)
1974 		return 0;
1975 
1976 	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1977 					       NULL, len);
1978 	if (IS_ERR(rskb))
1979 		return PTR_ERR(rskb);
1980 
1981 	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
1982 	bcn = (struct bss_info_bcn *)tlv;
1983 	bcn->enable = en;
1984 
1985 	if (!en)
1986 		goto out;
1987 
1988 	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
1989 	if (!skb)
1990 		return -EINVAL;
1991 
1992 	if (skb->len > MT7915_MAX_BEACON_SIZE - MT_TXD_SIZE) {
1993 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
1994 		dev_kfree_skb(skb);
1995 		return -EINVAL;
1996 	}
1997 
1998 	info = IEEE80211_SKB_CB(skb);
1999 	info->hw_queue = FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
2000 
2001 	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
2002 	mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
2003 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
2004 	dev_kfree_skb(skb);
2005 
2006 	if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP ||
2007 	    changed & BSS_CHANGED_FILS_DISCOVERY)
2008 		mt7915_mcu_beacon_inband_discov(dev, vif, rskb,
2009 						bcn, changed);
2010 
2011 out:
2012 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2013 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2014 }
2015 
2016 static int mt7915_driver_own(struct mt7915_dev *dev, u8 band)
2017 {
2018 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(band), MT_TOP_LPCR_HOST_DRV_OWN);
2019 	if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND(band),
2020 			    MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
2021 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2022 		return -EIO;
2023 	}
2024 
2025 	/* clear irq when the driver own success */
2026 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND_IRQ_STAT(band),
2027 		MT_TOP_LPCR_HOST_BAND_STAT);
2028 
2029 	return 0;
2030 }
2031 
2032 static int
2033 mt7915_firmware_state(struct mt7915_dev *dev, bool wa)
2034 {
2035 	u32 state = FIELD_PREP(MT_TOP_MISC_FW_STATE,
2036 			       wa ? FW_STATE_RDY : FW_STATE_FW_DOWNLOAD);
2037 
2038 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2039 			    state, 1000)) {
2040 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2041 		return -EIO;
2042 	}
2043 	return 0;
2044 }
2045 
2046 static int mt7915_load_firmware(struct mt7915_dev *dev)
2047 {
2048 	int ret;
2049 
2050 	/* make sure fw is download state */
2051 	if (mt7915_firmware_state(dev, false)) {
2052 		/* restart firmware once */
2053 		mt76_connac_mcu_restart(&dev->mt76);
2054 		ret = mt7915_firmware_state(dev, false);
2055 		if (ret) {
2056 			dev_err(dev->mt76.dev,
2057 				"Firmware is not ready for download\n");
2058 			return ret;
2059 		}
2060 	}
2061 
2062 	ret = mt76_connac2_load_patch(&dev->mt76, fw_name_var(dev, ROM_PATCH));
2063 	if (ret)
2064 		return ret;
2065 
2066 	ret = mt76_connac2_load_ram(&dev->mt76, fw_name_var(dev, FIRMWARE_WM),
2067 				    fw_name(dev, FIRMWARE_WA));
2068 	if (ret)
2069 		return ret;
2070 
2071 	ret = mt7915_firmware_state(dev, true);
2072 	if (ret)
2073 		return ret;
2074 
2075 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2076 
2077 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2078 
2079 	return 0;
2080 }
2081 
2082 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl)
2083 {
2084 	struct {
2085 		u8 ctrl_val;
2086 		u8 pad[3];
2087 	} data = {
2088 		.ctrl_val = ctrl
2089 	};
2090 
2091 	if (type == MCU_FW_LOG_WA)
2092 		return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(FW_LOG_2_HOST),
2093 					 &data, sizeof(data), true);
2094 
2095 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2096 				 sizeof(data), true);
2097 }
2098 
2099 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2100 {
2101 	struct {
2102 		u8 ver;
2103 		u8 pad;
2104 		__le16 len;
2105 		u8 level;
2106 		u8 rsv[3];
2107 		__le32 module_idx;
2108 	} data = {
2109 		.module_idx = cpu_to_le32(module),
2110 		.level = level,
2111 	};
2112 
2113 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2114 				 sizeof(data), false);
2115 }
2116 
2117 int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enabled)
2118 {
2119 	struct {
2120 		__le32 cmd;
2121 		u8 enable;
2122 	} data = {
2123 		.cmd = cpu_to_le32(MURU_SET_TXC_TX_STATS_EN),
2124 		.enable = enabled,
2125 	};
2126 
2127 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &data,
2128 				sizeof(data), false);
2129 }
2130 
2131 int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy)
2132 {
2133 	struct mt7915_dev *dev = phy->dev;
2134 	struct sk_buff *skb;
2135 	struct mt7915_mcu_muru_stats *mu_stats;
2136 	int ret;
2137 
2138 	struct {
2139 		__le32 cmd;
2140 		u8 band_idx;
2141 	} req = {
2142 		.cmd = cpu_to_le32(MURU_GET_TXC_TX_STATS),
2143 		.band_idx = phy->mt76->band_idx,
2144 	};
2145 
2146 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
2147 					&req, sizeof(req), true, &skb);
2148 	if (ret)
2149 		return ret;
2150 
2151 	mu_stats = (struct mt7915_mcu_muru_stats *)(skb->data);
2152 
2153 	/* accumulate stats, these are clear-on-read */
2154 #define __dl_u32(s)	 phy->mib.dl_##s += le32_to_cpu(mu_stats->dl.s)
2155 #define __ul_u32(s)	 phy->mib.ul_##s += le32_to_cpu(mu_stats->ul.s)
2156 	__dl_u32(cck_cnt);
2157 	__dl_u32(ofdm_cnt);
2158 	__dl_u32(htmix_cnt);
2159 	__dl_u32(htgf_cnt);
2160 	__dl_u32(vht_su_cnt);
2161 	__dl_u32(vht_2mu_cnt);
2162 	__dl_u32(vht_3mu_cnt);
2163 	__dl_u32(vht_4mu_cnt);
2164 	__dl_u32(he_su_cnt);
2165 	__dl_u32(he_2ru_cnt);
2166 	__dl_u32(he_2mu_cnt);
2167 	__dl_u32(he_3ru_cnt);
2168 	__dl_u32(he_3mu_cnt);
2169 	__dl_u32(he_4ru_cnt);
2170 	__dl_u32(he_4mu_cnt);
2171 	__dl_u32(he_5to8ru_cnt);
2172 	__dl_u32(he_9to16ru_cnt);
2173 	__dl_u32(he_gtr16ru_cnt);
2174 
2175 	__ul_u32(hetrig_su_cnt);
2176 	__ul_u32(hetrig_2ru_cnt);
2177 	__ul_u32(hetrig_3ru_cnt);
2178 	__ul_u32(hetrig_4ru_cnt);
2179 	__ul_u32(hetrig_5to8ru_cnt);
2180 	__ul_u32(hetrig_9to16ru_cnt);
2181 	__ul_u32(hetrig_gtr16ru_cnt);
2182 	__ul_u32(hetrig_2mu_cnt);
2183 	__ul_u32(hetrig_3mu_cnt);
2184 	__ul_u32(hetrig_4mu_cnt);
2185 #undef __dl_u32
2186 #undef __ul_u32
2187 
2188 	dev_kfree_skb(skb);
2189 
2190 	return 0;
2191 }
2192 
2193 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2194 {
2195 	struct {
2196 		u8 enable;
2197 		u8 _rsv[3];
2198 	} __packed req = {
2199 		.enable = enabled
2200 	};
2201 
2202 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2203 				 sizeof(req), false);
2204 }
2205 
2206 int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val)
2207 {
2208 	struct {
2209 		__le32 cmd;
2210 		u8 val[4];
2211 	} __packed req = {
2212 		.cmd = cpu_to_le32(cmd),
2213 	};
2214 
2215 	put_unaligned_le32(val, req.val);
2216 
2217 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
2218 				 sizeof(req), false);
2219 }
2220 
2221 static int
2222 mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
2223 {
2224 #define RX_AIRTIME_FEATURE_CTRL		1
2225 #define RX_AIRTIME_BITWISE_CTRL		2
2226 #define RX_AIRTIME_CLEAR_EN	1
2227 	struct {
2228 		__le16 field;
2229 		__le16 sub_field;
2230 		__le32 set_status;
2231 		__le32 get_status;
2232 		u8 _rsv[12];
2233 
2234 		bool airtime_en;
2235 		bool mibtime_en;
2236 		bool earlyend_en;
2237 		u8 _rsv1[9];
2238 
2239 		bool airtime_clear;
2240 		bool mibtime_clear;
2241 		u8 _rsv2[98];
2242 	} __packed req = {
2243 		.field = cpu_to_le16(RX_AIRTIME_BITWISE_CTRL),
2244 		.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN),
2245 		.airtime_clear = true,
2246 	};
2247 	int ret;
2248 
2249 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2250 				sizeof(req), true);
2251 	if (ret)
2252 		return ret;
2253 
2254 	req.field = cpu_to_le16(RX_AIRTIME_FEATURE_CTRL);
2255 	req.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN);
2256 	req.airtime_en = true;
2257 
2258 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2259 				 sizeof(req), true);
2260 }
2261 
2262 static int mt7915_red_set_watermark(struct mt7915_dev *dev)
2263 {
2264 #define RED_GLOBAL_TOKEN_WATERMARK 2
2265 	struct {
2266 		__le32 args[3];
2267 		u8 cmd;
2268 		u8 version;
2269 		u8 __rsv1[4];
2270 		__le16 len;
2271 		__le16 high_mark;
2272 		__le16 low_mark;
2273 		u8 __rsv2[12];
2274 	} __packed req = {
2275 		.args[0] = cpu_to_le32(MCU_WA_PARAM_RED_SETTING),
2276 		.cmd = RED_GLOBAL_TOKEN_WATERMARK,
2277 		.len = cpu_to_le16(sizeof(req) - sizeof(req.args)),
2278 		.high_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256),
2279 		.low_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256 - 1536),
2280 	};
2281 
2282 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET), &req,
2283 				 sizeof(req), false);
2284 }
2285 
2286 static int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
2287 {
2288 #define RED_DISABLE		0
2289 #define RED_BY_WA_ENABLE	2
2290 	int ret;
2291 	u32 red_type = enabled ? RED_BY_WA_ENABLE : RED_DISABLE;
2292 	__le32 req = cpu_to_le32(red_type);
2293 
2294 	if (enabled) {
2295 		ret = mt7915_red_set_watermark(dev);
2296 		if (ret < 0)
2297 			return ret;
2298 	}
2299 
2300 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RED_ENABLE), &req,
2301 				sizeof(req), false);
2302 	if (ret < 0)
2303 		return ret;
2304 
2305 	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
2306 				 MCU_WA_PARAM_RED, enabled, 0);
2307 }
2308 
2309 int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
2310 {
2311 	int ret;
2312 
2313 	/* force firmware operation mode into normal state,
2314 	 * which should be set before firmware download stage.
2315 	 */
2316 	mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
2317 
2318 	ret = mt7915_driver_own(dev, 0);
2319 	if (ret)
2320 		return ret;
2321 	/* set driver own for band1 when two hif exist */
2322 	if (dev->hif2) {
2323 		ret = mt7915_driver_own(dev, 1);
2324 		if (ret)
2325 			return ret;
2326 	}
2327 
2328 	ret = mt7915_load_firmware(dev);
2329 	if (ret)
2330 		return ret;
2331 
2332 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2333 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
2334 	if (ret)
2335 		return ret;
2336 
2337 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, 0);
2338 	if (ret)
2339 		return ret;
2340 
2341 	if ((mtk_wed_device_active(&dev->mt76.mmio.wed) &&
2342 	     is_mt7915(&dev->mt76)) ||
2343 	    !mtk_wed_get_rx_capa(&dev->mt76.mmio.wed))
2344 		mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
2345 
2346 	ret = mt7915_mcu_set_mwds(dev, 1);
2347 	if (ret)
2348 		return ret;
2349 
2350 	ret = mt7915_mcu_set_muru_ctrl(dev, MURU_SET_PLATFORM_TYPE,
2351 				       MURU_PLATFORM_TYPE_PERF_LEVEL_2);
2352 	if (ret)
2353 		return ret;
2354 
2355 	ret = mt7915_mcu_init_rx_airtime(dev);
2356 	if (ret)
2357 		return ret;
2358 
2359 	return mt7915_mcu_set_red(dev, mtk_wed_device_active(&dev->mt76.mmio.wed));
2360 }
2361 
2362 int mt7915_mcu_init(struct mt7915_dev *dev)
2363 {
2364 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
2365 		.headroom = sizeof(struct mt76_connac2_mcu_txd),
2366 		.mcu_skb_send_msg = mt7915_mcu_send_message,
2367 		.mcu_parse_response = mt7915_mcu_parse_response,
2368 	};
2369 
2370 	dev->mt76.mcu_ops = &mt7915_mcu_ops;
2371 
2372 	return mt7915_mcu_init_firmware(dev);
2373 }
2374 
2375 void mt7915_mcu_exit(struct mt7915_dev *dev)
2376 {
2377 	mt76_connac_mcu_restart(&dev->mt76);
2378 	if (mt7915_firmware_state(dev, false)) {
2379 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2380 		goto out;
2381 	}
2382 
2383 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
2384 	if (dev->hif2)
2385 		mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
2386 			MT_TOP_LPCR_HOST_FW_OWN);
2387 out:
2388 	skb_queue_purge(&dev->mt76.mcu.res_q);
2389 }
2390 
2391 static int
2392 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
2393 {
2394 	struct {
2395 		u8 operation;
2396 		u8 count;
2397 		u8 _rsv[2];
2398 		u8 index;
2399 		u8 enable;
2400 		__le16 etype;
2401 	} req = {
2402 		.operation = 1,
2403 		.count = 1,
2404 		.enable = 1,
2405 		.etype = cpu_to_le16(ETH_P_PAE),
2406 	};
2407 
2408 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2409 				 &req, sizeof(req), false);
2410 }
2411 
2412 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2413 		       bool enable, bool hdr_trans)
2414 {
2415 	struct {
2416 		u8 operation;
2417 		u8 enable;
2418 		u8 check_bssid;
2419 		u8 insert_vlan;
2420 		u8 remove_vlan;
2421 		u8 tid;
2422 		u8 mode;
2423 		u8 rsv;
2424 	} __packed req_trans = {
2425 		.enable = hdr_trans,
2426 	};
2427 	struct {
2428 		u8 enable;
2429 		u8 band;
2430 		u8 rsv[2];
2431 	} __packed req_mac = {
2432 		.enable = enable,
2433 		.band = band,
2434 	};
2435 	int ret;
2436 
2437 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2438 				&req_trans, sizeof(req_trans), false);
2439 	if (ret)
2440 		return ret;
2441 
2442 	if (hdr_trans)
2443 		mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
2444 
2445 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2446 				 &req_mac, sizeof(req_mac), true);
2447 }
2448 
2449 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2450 {
2451 	struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2452 	u8 num = req->total;
2453 	size_t len = sizeof(*req) -
2454 		     (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2455 
2456 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
2457 				 len, true);
2458 }
2459 
2460 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2461 {
2462 #define TX_CMD_MODE		1
2463 	struct mt7915_mcu_tx req = {
2464 		.valid = true,
2465 		.mode = TX_CMD_MODE,
2466 		.total = IEEE80211_NUM_ACS,
2467 	};
2468 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2469 	int ac;
2470 
2471 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2472 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2473 		struct edca *e = &req.edca[ac];
2474 
2475 		e->set = WMM_PARAM_SET;
2476 		e->queue = ac + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
2477 		e->aifs = q->aifs;
2478 		e->txop = cpu_to_le16(q->txop);
2479 
2480 		if (q->cw_min)
2481 			e->cw_min = fls(q->cw_min);
2482 		else
2483 			e->cw_min = 5;
2484 
2485 		if (q->cw_max)
2486 			e->cw_max = cpu_to_le16(fls(q->cw_max));
2487 		else
2488 			e->cw_max = cpu_to_le16(10);
2489 	}
2490 
2491 	return mt7915_mcu_update_edca(dev, &req);
2492 }
2493 
2494 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
2495 {
2496 	struct {
2497 		__le32 tag;
2498 		__le16 min_lpn;
2499 		u8 rsv[2];
2500 	} __packed req = {
2501 		.tag = cpu_to_le32(0x1),
2502 		.min_lpn = cpu_to_le16(val),
2503 	};
2504 
2505 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2506 				 sizeof(req), true);
2507 }
2508 
2509 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
2510 			    const struct mt7915_dfs_pulse *pulse)
2511 {
2512 	struct {
2513 		__le32 tag;
2514 
2515 		__le32 max_width;		/* us */
2516 		__le32 max_pwr;			/* dbm */
2517 		__le32 min_pwr;			/* dbm */
2518 		__le32 min_stgr_pri;		/* us */
2519 		__le32 max_stgr_pri;		/* us */
2520 		__le32 min_cr_pri;		/* us */
2521 		__le32 max_cr_pri;		/* us */
2522 	} __packed req = {
2523 		.tag = cpu_to_le32(0x3),
2524 
2525 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2526 		__req_field(max_width),
2527 		__req_field(max_pwr),
2528 		__req_field(min_pwr),
2529 		__req_field(min_stgr_pri),
2530 		__req_field(max_stgr_pri),
2531 		__req_field(min_cr_pri),
2532 		__req_field(max_cr_pri),
2533 #undef __req_field
2534 	};
2535 
2536 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2537 				 sizeof(req), true);
2538 }
2539 
2540 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
2541 			    const struct mt7915_dfs_pattern *pattern)
2542 {
2543 	struct {
2544 		__le32 tag;
2545 		__le16 radar_type;
2546 
2547 		u8 enb;
2548 		u8 stgr;
2549 		u8 min_crpn;
2550 		u8 max_crpn;
2551 		u8 min_crpr;
2552 		u8 min_pw;
2553 		__le32 min_pri;
2554 		__le32 max_pri;
2555 		u8 max_pw;
2556 		u8 min_crbn;
2557 		u8 max_crbn;
2558 		u8 min_stgpn;
2559 		u8 max_stgpn;
2560 		u8 min_stgpr;
2561 		u8 rsv[2];
2562 		__le32 min_stgpr_diff;
2563 	} __packed req = {
2564 		.tag = cpu_to_le32(0x2),
2565 		.radar_type = cpu_to_le16(index),
2566 
2567 #define __req_field_u8(field) .field = pattern->field
2568 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2569 		__req_field_u8(enb),
2570 		__req_field_u8(stgr),
2571 		__req_field_u8(min_crpn),
2572 		__req_field_u8(max_crpn),
2573 		__req_field_u8(min_crpr),
2574 		__req_field_u8(min_pw),
2575 		__req_field_u32(min_pri),
2576 		__req_field_u32(max_pri),
2577 		__req_field_u8(max_pw),
2578 		__req_field_u8(min_crbn),
2579 		__req_field_u8(max_crbn),
2580 		__req_field_u8(min_stgpn),
2581 		__req_field_u8(max_stgpn),
2582 		__req_field_u8(min_stgpr),
2583 		__req_field_u32(min_stgpr_diff),
2584 #undef __req_field_u8
2585 #undef __req_field_u32
2586 	};
2587 
2588 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2589 				 sizeof(req), true);
2590 }
2591 
2592 static int
2593 mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
2594 				 struct cfg80211_chan_def *chandef,
2595 				 int cmd)
2596 {
2597 	struct mt7915_dev *dev = phy->dev;
2598 	struct mt76_phy *mphy = phy->mt76;
2599 	struct ieee80211_channel *chan = mphy->chandef.chan;
2600 	int freq = mphy->chandef.center_freq1;
2601 	struct mt7915_mcu_background_chain_ctrl req = {
2602 		.monitor_scan_type = 2, /* simple rx */
2603 	};
2604 
2605 	if (!chandef && cmd != CH_SWITCH_BACKGROUND_SCAN_STOP)
2606 		return -EINVAL;
2607 
2608 	if (!cfg80211_chandef_valid(&mphy->chandef))
2609 		return -EINVAL;
2610 
2611 	switch (cmd) {
2612 	case CH_SWITCH_BACKGROUND_SCAN_START: {
2613 		req.chan = chan->hw_value;
2614 		req.central_chan = ieee80211_frequency_to_channel(freq);
2615 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2616 		req.monitor_chan = chandef->chan->hw_value;
2617 		req.monitor_central_chan =
2618 			ieee80211_frequency_to_channel(chandef->center_freq1);
2619 		req.monitor_bw = mt76_connac_chan_bw(chandef);
2620 		req.band_idx = phy->mt76->band_idx;
2621 		req.scan_mode = 1;
2622 		break;
2623 	}
2624 	case CH_SWITCH_BACKGROUND_SCAN_RUNNING:
2625 		req.monitor_chan = chandef->chan->hw_value;
2626 		req.monitor_central_chan =
2627 			ieee80211_frequency_to_channel(chandef->center_freq1);
2628 		req.band_idx = phy->mt76->band_idx;
2629 		req.scan_mode = 2;
2630 		break;
2631 	case CH_SWITCH_BACKGROUND_SCAN_STOP:
2632 		req.chan = chan->hw_value;
2633 		req.central_chan = ieee80211_frequency_to_channel(freq);
2634 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2635 		req.tx_stream = hweight8(mphy->antenna_mask);
2636 		req.rx_stream = mphy->antenna_mask;
2637 		break;
2638 	default:
2639 		return -EINVAL;
2640 	}
2641 	req.band = chandef ? chandef->chan->band == NL80211_BAND_5GHZ : 1;
2642 
2643 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(OFFCH_SCAN_CTRL),
2644 				 &req, sizeof(req), false);
2645 }
2646 
2647 int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
2648 				     struct cfg80211_chan_def *chandef)
2649 {
2650 	struct mt7915_dev *dev = phy->dev;
2651 	int err, region;
2652 
2653 	if (!chandef) { /* disable offchain */
2654 		err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_STOP, MT_RX_SEL2,
2655 					      0, 0);
2656 		if (err)
2657 			return err;
2658 
2659 		return mt7915_mcu_background_chain_ctrl(phy, NULL,
2660 				CH_SWITCH_BACKGROUND_SCAN_STOP);
2661 	}
2662 
2663 	err = mt7915_mcu_background_chain_ctrl(phy, chandef,
2664 					       CH_SWITCH_BACKGROUND_SCAN_START);
2665 	if (err)
2666 		return err;
2667 
2668 	switch (dev->mt76.region) {
2669 	case NL80211_DFS_ETSI:
2670 		region = 0;
2671 		break;
2672 	case NL80211_DFS_JP:
2673 		region = 2;
2674 		break;
2675 	case NL80211_DFS_FCC:
2676 	default:
2677 		region = 1;
2678 		break;
2679 	}
2680 
2681 	return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_START, MT_RX_SEL2,
2682 				       0, region);
2683 }
2684 
2685 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
2686 {
2687 	static const u8 ch_band[] = {
2688 		[NL80211_BAND_2GHZ] = 0,
2689 		[NL80211_BAND_5GHZ] = 1,
2690 		[NL80211_BAND_6GHZ] = 2,
2691 	};
2692 	struct mt7915_dev *dev = phy->dev;
2693 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2694 	int freq1 = chandef->center_freq1;
2695 	u8 band = phy->mt76->band_idx;
2696 	struct {
2697 		u8 control_ch;
2698 		u8 center_ch;
2699 		u8 bw;
2700 		u8 tx_path_num;
2701 		u8 rx_path;	/* mask or num */
2702 		u8 switch_reason;
2703 		u8 band_idx;
2704 		u8 center_ch2;	/* for 80+80 only */
2705 		__le16 cac_case;
2706 		u8 channel_band;
2707 		u8 rsv0;
2708 		__le32 outband_freq;
2709 		u8 txpower_drop;
2710 		u8 ap_bw;
2711 		u8 ap_center_ch;
2712 		u8 rsv1[57];
2713 	} __packed req = {
2714 		.control_ch = chandef->chan->hw_value,
2715 		.center_ch = ieee80211_frequency_to_channel(freq1),
2716 		.bw = mt76_connac_chan_bw(chandef),
2717 		.tx_path_num = hweight16(phy->mt76->chainmask),
2718 		.rx_path = phy->mt76->chainmask >> (dev->chainshift * band),
2719 		.band_idx = band,
2720 		.channel_band = ch_band[chandef->chan->band],
2721 	};
2722 
2723 #ifdef CONFIG_NL80211_TESTMODE
2724 	if (phy->mt76->test.tx_antenna_mask &&
2725 	    mt76_testmode_enabled(phy->mt76)) {
2726 		req.tx_path_num = fls(phy->mt76->test.tx_antenna_mask);
2727 		req.rx_path = phy->mt76->test.tx_antenna_mask;
2728 	}
2729 #endif
2730 
2731 	if (mt76_connac_spe_idx(phy->mt76->antenna_mask))
2732 		req.tx_path_num = fls(phy->mt76->antenna_mask);
2733 
2734 	if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
2735 	    dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
2736 		req.switch_reason = CH_SWITCH_NORMAL;
2737 	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2738 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2739 	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2740 					  NL80211_IFTYPE_AP))
2741 		req.switch_reason = CH_SWITCH_DFS;
2742 	else
2743 		req.switch_reason = CH_SWITCH_NORMAL;
2744 
2745 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
2746 		req.rx_path = hweight8(req.rx_path);
2747 
2748 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
2749 		int freq2 = chandef->center_freq2;
2750 
2751 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
2752 	}
2753 
2754 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2755 }
2756 
2757 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
2758 {
2759 #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
2760 #define PAGE_IDX_MASK		GENMASK(4, 2)
2761 #define PER_PAGE_SIZE		0x400
2762 	struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
2763 	u16 eeprom_size = mt7915_eeprom_size(dev);
2764 	u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
2765 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
2766 	int eep_len;
2767 	int i;
2768 
2769 	for (i = 0; i < total; i++, eep += eep_len) {
2770 		struct sk_buff *skb;
2771 		int ret;
2772 
2773 		if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
2774 			eep_len = eeprom_size % PER_PAGE_SIZE;
2775 		else
2776 			eep_len = PER_PAGE_SIZE;
2777 
2778 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2779 					 sizeof(req) + eep_len);
2780 		if (!skb)
2781 			return -ENOMEM;
2782 
2783 		req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
2784 			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
2785 		req.len = cpu_to_le16(eep_len);
2786 
2787 		skb_put_data(skb, &req, sizeof(req));
2788 		skb_put_data(skb, eep, eep_len);
2789 
2790 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2791 					    MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
2792 		if (ret)
2793 			return ret;
2794 	}
2795 
2796 	return 0;
2797 }
2798 
2799 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
2800 {
2801 	struct mt7915_mcu_eeprom req = {
2802 		.buffer_mode = EE_MODE_EFUSE,
2803 		.format = EE_FORMAT_WHOLE,
2804 	};
2805 
2806 	if (dev->flash_mode)
2807 		return mt7915_mcu_set_eeprom_flash(dev);
2808 
2809 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
2810 				 &req, sizeof(req), true);
2811 }
2812 
2813 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
2814 {
2815 	struct mt7915_mcu_eeprom_info req = {
2816 		.addr = cpu_to_le32(round_down(offset,
2817 				    MT7915_EEPROM_BLOCK_SIZE)),
2818 	};
2819 	struct mt7915_mcu_eeprom_info *res;
2820 	struct sk_buff *skb;
2821 	int ret;
2822 	u8 *buf;
2823 
2824 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
2825 					MCU_EXT_QUERY(EFUSE_ACCESS),
2826 					&req, sizeof(req), true, &skb);
2827 	if (ret)
2828 		return ret;
2829 
2830 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
2831 #if defined(__linux__)
2832 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
2833 #elif defined(__FreeBSD__)
2834 	buf = (u8 *)dev->mt76.eeprom.data + le32_to_cpu(res->addr);
2835 #endif
2836 	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
2837 	dev_kfree_skb(skb);
2838 
2839 	return 0;
2840 }
2841 
2842 int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num)
2843 {
2844 	struct {
2845 		u8 _rsv;
2846 		u8 version;
2847 		u8 die_idx;
2848 		u8 _rsv2;
2849 	} __packed req = {
2850 		.version = 1,
2851 	};
2852 	struct sk_buff *skb;
2853 	int ret;
2854 
2855 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
2856 					MCU_EXT_QUERY(EFUSE_FREE_BLOCK),
2857 					&req, sizeof(req), true, &skb);
2858 	if (ret)
2859 		return ret;
2860 
2861 	*block_num = *(u8 *)skb->data;
2862 	dev_kfree_skb(skb);
2863 
2864 	return 0;
2865 }
2866 
2867 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
2868 				  u8 *data, u32 len, int cmd)
2869 {
2870 	struct {
2871 		u8 dir;
2872 		u8 valid;
2873 		__le16 bitmap;
2874 		s8 precal;
2875 		u8 action;
2876 		u8 band;
2877 		u8 idx;
2878 		u8 rsv[4];
2879 		__le32 len;
2880 	} req = {};
2881 	struct sk_buff *skb;
2882 
2883 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
2884 	if (!skb)
2885 		return -ENOMEM;
2886 
2887 	req.idx = idx;
2888 	req.len = cpu_to_le32(len);
2889 	skb_put_data(skb, &req, sizeof(req));
2890 	skb_put_data(skb, data, len);
2891 
2892 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
2893 }
2894 
2895 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
2896 {
2897 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
2898 	u32 total = MT_EE_CAL_GROUP_SIZE;
2899 
2900 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
2901 		return 0;
2902 
2903 	/*
2904 	 * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
2905 	 * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
2906 	 */
2907 	while (total > 0) {
2908 		int ret, len;
2909 
2910 		len = min_t(u32, total, MT_EE_CAL_UNIT);
2911 
2912 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
2913 					     MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
2914 		if (ret)
2915 			return ret;
2916 
2917 		total -= len;
2918 		cal += len;
2919 		idx++;
2920 	}
2921 
2922 	return 0;
2923 }
2924 
2925 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2926 {
2927 	int i;
2928 
2929 	for (i = 0; i < n_freqs; i++)
2930 		if (cur == freqs[i])
2931 			return i;
2932 
2933 	return -1;
2934 }
2935 
2936 static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
2937 {
2938 	static const u16 freq_list[] = {
2939 		5180, 5200, 5220, 5240,
2940 		5260, 5280, 5300, 5320,
2941 		5500, 5520, 5540, 5560,
2942 		5580, 5600, 5620, 5640,
2943 		5660, 5680, 5700, 5745,
2944 		5765, 5785, 5805, 5825
2945 	};
2946 	int offset_2g = ARRAY_SIZE(freq_list);
2947 	int idx;
2948 
2949 	if (freq < 4000) {
2950 		if (freq < 2432)
2951 			return offset_2g;
2952 		if (freq < 2457)
2953 			return offset_2g + 1;
2954 
2955 		return offset_2g + 2;
2956 	}
2957 
2958 	if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
2959 		return -1;
2960 
2961 	if (bw != NL80211_CHAN_WIDTH_20) {
2962 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2963 					   freq + 10);
2964 		if (idx >= 0)
2965 			return idx;
2966 
2967 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2968 					   freq - 10);
2969 		if (idx >= 0)
2970 			return idx;
2971 	}
2972 
2973 	return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2974 }
2975 
2976 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
2977 {
2978 	struct mt7915_dev *dev = phy->dev;
2979 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2980 	u16 total = 2, center_freq = chandef->center_freq1;
2981 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
2982 	int idx;
2983 
2984 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
2985 		return 0;
2986 
2987 	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
2988 	if (idx < 0)
2989 		return -EINVAL;
2990 
2991 	/* Items: Tx DPD, Tx Flatness */
2992 	idx = idx * 2;
2993 	cal += MT_EE_CAL_GROUP_SIZE;
2994 
2995 	while (total--) {
2996 		int ret;
2997 
2998 		cal += (idx * MT_EE_CAL_UNIT);
2999 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
3000 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
3001 		if (ret)
3002 			return ret;
3003 
3004 		idx++;
3005 	}
3006 
3007 	return 0;
3008 }
3009 
3010 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
3011 {
3012 	struct mt76_channel_state *state = phy->mt76->chan_state;
3013 	struct mt76_channel_state *state_ts = &phy->state_ts;
3014 	struct mt7915_dev *dev = phy->dev;
3015 	struct mt7915_mcu_mib *res, req[5];
3016 	struct sk_buff *skb;
3017 	static const u32 *offs;
3018 	int i, ret, len, offs_cc;
3019 	u64 cc_tx;
3020 
3021 	/* strict order */
3022 	if (is_mt7915(&dev->mt76)) {
3023 		static const u32 chip_offs[] = {
3024 			MIB_NON_WIFI_TIME,
3025 			MIB_TX_TIME,
3026 			MIB_RX_TIME,
3027 			MIB_OBSS_AIRTIME,
3028 			MIB_TXOP_INIT_COUNT,
3029 		};
3030 		len = ARRAY_SIZE(chip_offs);
3031 		offs = chip_offs;
3032 		offs_cc = 20;
3033 	} else {
3034 		static const u32 chip_offs[] = {
3035 			MIB_NON_WIFI_TIME_V2,
3036 			MIB_TX_TIME_V2,
3037 			MIB_RX_TIME_V2,
3038 			MIB_OBSS_AIRTIME_V2
3039 		};
3040 		len = ARRAY_SIZE(chip_offs);
3041 		offs = chip_offs;
3042 		offs_cc = 0;
3043 	}
3044 
3045 	for (i = 0; i < len; i++) {
3046 		req[i].band = cpu_to_le32(phy->mt76->band_idx);
3047 		req[i].offs = cpu_to_le32(offs[i]);
3048 	}
3049 
3050 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
3051 					req, len * sizeof(req[0]), true, &skb);
3052 	if (ret)
3053 		return ret;
3054 
3055 	res = (struct mt7915_mcu_mib *)(skb->data + offs_cc);
3056 
3057 #define __res_u64(s) le64_to_cpu(res[s].data)
3058 	/* subtract Tx backoff time from Tx duration */
3059 	cc_tx = is_mt7915(&dev->mt76) ? __res_u64(1) - __res_u64(4) : __res_u64(1);
3060 
3061 	if (chan_switch)
3062 		goto out;
3063 
3064 	state->cc_tx += cc_tx - state_ts->cc_tx;
3065 	state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
3066 	state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
3067 	state->cc_busy += __res_u64(0) + cc_tx + __res_u64(2) + __res_u64(3) -
3068 			  state_ts->cc_busy;
3069 
3070 out:
3071 	state_ts->cc_tx = cc_tx;
3072 	state_ts->cc_bss_rx = __res_u64(2);
3073 	state_ts->cc_rx = __res_u64(2) + __res_u64(3);
3074 	state_ts->cc_busy = __res_u64(0) + cc_tx + __res_u64(2) + __res_u64(3);
3075 #undef __res_u64
3076 
3077 	dev_kfree_skb(skb);
3078 
3079 	return 0;
3080 }
3081 
3082 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
3083 {
3084 	struct mt7915_dev *dev = phy->dev;
3085 	struct {
3086 		u8 ctrl_id;
3087 		u8 action;
3088 		u8 band_idx;
3089 		u8 rsv[5];
3090 	} req = {
3091 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3092 		.band_idx = phy->mt76->band_idx,
3093 	};
3094 
3095 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3096 				 sizeof(req), true);
3097 }
3098 
3099 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
3100 {
3101 	struct mt7915_dev *dev = phy->dev;
3102 	struct mt7915_mcu_thermal_ctrl req = {
3103 		.band_idx = phy->mt76->band_idx,
3104 		.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG,
3105 	};
3106 	int level, ret;
3107 
3108 	/* set duty cycle and level */
3109 	for (level = 0; level < 4; level++) {
3110 		req.duty.duty_level = level;
3111 		req.duty.duty_cycle = state;
3112 		state /= 2;
3113 
3114 		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3115 					&req, sizeof(req), false);
3116 		if (ret)
3117 			return ret;
3118 	}
3119 	return 0;
3120 }
3121 
3122 int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy)
3123 {
3124 	struct mt7915_dev *dev = phy->dev;
3125 	struct {
3126 		struct mt7915_mcu_thermal_ctrl ctrl;
3127 
3128 		__le32 trigger_temp;
3129 		__le32 restore_temp;
3130 		__le16 sustain_time;
3131 		u8 rsv[2];
3132 	} __packed req = {
3133 		.ctrl = {
3134 			.band_idx = phy->mt76->band_idx,
3135 			.type.protect_type = 1,
3136 			.type.trigger_type = 1,
3137 		},
3138 	};
3139 	int ret;
3140 
3141 	req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3142 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3143 				&req, sizeof(req.ctrl), false);
3144 
3145 	if (ret)
3146 		return ret;
3147 
3148 	/* set high-temperature trigger threshold */
3149 	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3150 	/* add a safety margin ~10 */
3151 	req.restore_temp = cpu_to_le32(phy->throttle_temp[0] - 10);
3152 	req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
3153 	req.sustain_time = cpu_to_le16(10);
3154 
3155 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3156 				 &req, sizeof(req), false);
3157 }
3158 
3159 int mt7915_mcu_set_txpower_frame_min(struct mt7915_phy *phy, s8 txpower)
3160 {
3161 	struct mt7915_dev *dev = phy->dev;
3162 	struct {
3163 		u8 format_id;
3164 		u8 rsv;
3165 		u8 band_idx;
3166 		s8 txpower_min;
3167 	} __packed req = {
3168 		.format_id = TX_POWER_LIMIT_FRAME_MIN,
3169 		.band_idx = phy->mt76->band_idx,
3170 		.txpower_min = txpower * 2, /* 0.5db */
3171 	};
3172 
3173 	return mt76_mcu_send_msg(&dev->mt76,
3174 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3175 				 sizeof(req), true);
3176 }
3177 
3178 int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
3179 				 struct ieee80211_vif *vif,
3180 				 struct ieee80211_sta *sta, s8 txpower)
3181 {
3182 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3183 	struct mt7915_dev *dev = phy->dev;
3184 	struct mt76_phy *mphy = phy->mt76;
3185 	struct {
3186 		u8 format_id;
3187 		u8 rsv[3];
3188 		u8 band_idx;
3189 		s8 txpower_max;
3190 		__le16 wcid;
3191 		s8 txpower_offs[48];
3192 	} __packed req = {
3193 		.format_id = TX_POWER_LIMIT_FRAME,
3194 		.band_idx = phy->mt76->band_idx,
3195 		.txpower_max = DIV_ROUND_UP(mphy->txpower_cur, 2),
3196 		.wcid = cpu_to_le16(msta->wcid.idx),
3197 	};
3198 	int ret;
3199 	s8 txpower_sku[MT7915_SKU_RATE_NUM];
3200 
3201 	ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku));
3202 	if (ret)
3203 		return ret;
3204 
3205 	txpower = mt7915_get_power_bound(phy, txpower);
3206 	if (txpower > mphy->txpower_cur || txpower < 0)
3207 		return -EINVAL;
3208 
3209 	if (txpower) {
3210 		u32 offs, len, i;
3211 
3212 		if (sta->deflink.ht_cap.ht_supported) {
3213 			const u8 *sku_len = mt7915_sku_group_len;
3214 
3215 			offs = sku_len[SKU_CCK] + sku_len[SKU_OFDM];
3216 			len = sku_len[SKU_HT_BW20] + sku_len[SKU_HT_BW40];
3217 
3218 			if (sta->deflink.vht_cap.vht_supported) {
3219 				offs += len;
3220 				len = sku_len[SKU_VHT_BW20] * 4;
3221 
3222 				if (sta->deflink.he_cap.has_he) {
3223 					offs += len + sku_len[SKU_HE_RU26] * 3;
3224 					len = sku_len[SKU_HE_RU242] * 4;
3225 				}
3226 			}
3227 		} else {
3228 			return -EINVAL;
3229 		}
3230 
3231 		for (i = 0; i < len; i++, offs++)
3232 			req.txpower_offs[i] =
3233 				DIV_ROUND_UP(txpower - txpower_sku[offs], 2);
3234 	}
3235 
3236 	return mt76_mcu_send_msg(&dev->mt76,
3237 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3238 				 sizeof(req), true);
3239 }
3240 
3241 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3242 {
3243 	struct mt7915_dev *dev = phy->dev;
3244 	struct mt76_phy *mphy = phy->mt76;
3245 	struct ieee80211_hw *hw = mphy->hw;
3246 	struct mt7915_mcu_txpower_sku req = {
3247 		.format_id = TX_POWER_LIMIT_TABLE,
3248 		.band_idx = phy->mt76->band_idx,
3249 	};
3250 	struct mt76_power_limits limits_array;
3251 	s8 *la = (s8 *)&limits_array;
3252 	int i, idx;
3253 	int tx_power;
3254 
3255 	tx_power = mt7915_get_power_bound(phy, hw->conf.power_level);
3256 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3257 					      &limits_array, tx_power);
3258 	mphy->txpower_cur = tx_power;
3259 
3260 	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3261 		u8 mcs_num, len = mt7915_sku_group_len[i];
3262 		int j;
3263 
3264 		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3265 			mcs_num = 10;
3266 
3267 			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3268 				la = (s8 *)&limits_array + 12;
3269 		} else {
3270 			mcs_num = len;
3271 		}
3272 
3273 		for (j = 0; j < min_t(u8, mcs_num, len); j++)
3274 			req.txpower_sku[idx + j] = la[j];
3275 
3276 		la += mcs_num;
3277 		idx += len;
3278 	}
3279 
3280 	return mt76_mcu_send_msg(&dev->mt76,
3281 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3282 				 sizeof(req), true);
3283 }
3284 
3285 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
3286 {
3287 #define RATE_POWER_INFO	2
3288 	struct mt7915_dev *dev = phy->dev;
3289 	struct {
3290 		u8 format_id;
3291 		u8 category;
3292 		u8 band_idx;
3293 		u8 _rsv;
3294 	} __packed req = {
3295 		.format_id = TX_POWER_LIMIT_INFO,
3296 		.category = RATE_POWER_INFO,
3297 		.band_idx = phy->mt76->band_idx,
3298 	};
3299 	s8 txpower_sku[MT7915_SKU_RATE_NUM][2];
3300 	struct sk_buff *skb;
3301 	int ret, i;
3302 
3303 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3304 					MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3305 					&req, sizeof(req), true, &skb);
3306 	if (ret)
3307 		return ret;
3308 
3309 	memcpy(txpower_sku, skb->data + 4, sizeof(txpower_sku));
3310 	for (i = 0; i < len; i++)
3311 		txpower[i] = txpower_sku[i][req.band_idx];
3312 
3313 	dev_kfree_skb(skb);
3314 
3315 	return 0;
3316 }
3317 
3318 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3319 			      u8 en)
3320 {
3321 	struct {
3322 		u8 test_mode_en;
3323 		u8 param_idx;
3324 		u8 _rsv[2];
3325 
3326 		u8 enable;
3327 		u8 _rsv2[3];
3328 
3329 		u8 pad[8];
3330 	} __packed req = {
3331 		.test_mode_en = test_mode,
3332 		.param_idx = param,
3333 		.enable = en,
3334 	};
3335 
3336 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3337 				 sizeof(req), false);
3338 }
3339 
3340 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3341 {
3342 	struct mt7915_dev *dev = phy->dev;
3343 	struct mt7915_sku {
3344 		u8 format_id;
3345 		u8 sku_enable;
3346 		u8 band_idx;
3347 		u8 rsv;
3348 	} __packed req = {
3349 		.format_id = TX_POWER_LIMIT_ENABLE,
3350 		.band_idx = phy->mt76->band_idx,
3351 		.sku_enable = enable,
3352 	};
3353 
3354 	return mt76_mcu_send_msg(&dev->mt76,
3355 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3356 				 sizeof(req), true);
3357 }
3358 
3359 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3360 {
3361 	struct {
3362 		u8 action;
3363 		u8 set;
3364 		u8 band;
3365 		u8 rsv;
3366 	} req = {
3367 		.action = action,
3368 		.set = set,
3369 		.band = band,
3370 	};
3371 
3372 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3373 				 &req, sizeof(req), false);
3374 }
3375 
3376 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
3377 {
3378 	struct {
3379 		u8 action;
3380 		union {
3381 			struct {
3382 				u8 snd_mode;
3383 				u8 sta_num;
3384 				u8 rsv;
3385 				u8 wlan_idx[4];
3386 				__le32 snd_period;	/* ms */
3387 			} __packed snd;
3388 			struct {
3389 				bool ebf;
3390 				bool ibf;
3391 				u8 rsv;
3392 			} __packed type;
3393 			struct {
3394 				u8 bf_num;
3395 				u8 bf_bitmap;
3396 				u8 bf_sel[8];
3397 				u8 rsv[5];
3398 			} __packed mod;
3399 		};
3400 	} __packed req = {
3401 		.action = action,
3402 	};
3403 
3404 #define MT_BF_PROCESSING	4
3405 	switch (action) {
3406 	case MT_BF_SOUNDING_ON:
3407 		req.snd.snd_mode = MT_BF_PROCESSING;
3408 		break;
3409 	case MT_BF_TYPE_UPDATE:
3410 		req.type.ebf = true;
3411 		req.type.ibf = dev->ibf;
3412 		break;
3413 	case MT_BF_MODULE_UPDATE:
3414 		req.mod.bf_num = 2;
3415 		req.mod.bf_bitmap = GENMASK(1, 0);
3416 		break;
3417 	default:
3418 		return -EINVAL;
3419 	}
3420 
3421 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3422 				 sizeof(req), true);
3423 }
3424 
3425 static int
3426 mt7915_mcu_enable_obss_spr(struct mt7915_phy *phy, u8 action, u8 val)
3427 {
3428 	struct mt7915_dev *dev = phy->dev;
3429 	struct mt7915_mcu_sr_ctrl req = {
3430 		.action = action,
3431 		.argnum = 1,
3432 		.band_idx = phy->mt76->band_idx,
3433 		.val = cpu_to_le32(val),
3434 	};
3435 
3436 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3437 				 sizeof(req), true);
3438 }
3439 
3440 static int
3441 mt7915_mcu_set_obss_spr_pd(struct mt7915_phy *phy,
3442 			   struct ieee80211_he_obss_pd *he_obss_pd)
3443 {
3444 	struct mt7915_dev *dev = phy->dev;
3445 	struct {
3446 		struct mt7915_mcu_sr_ctrl ctrl;
3447 		struct {
3448 			u8 pd_th_non_srg;
3449 			u8 pd_th_srg;
3450 			u8 period_offs;
3451 			u8 rcpi_src;
3452 			__le16 obss_pd_min;
3453 			__le16 obss_pd_min_srg;
3454 			u8 resp_txpwr_mode;
3455 			u8 txpwr_restrict_mode;
3456 			u8 txpwr_ref;
3457 			u8 rsv[3];
3458 		} __packed param;
3459 	} __packed req = {
3460 		.ctrl = {
3461 			.action = SPR_SET_PARAM,
3462 			.argnum = 9,
3463 			.band_idx = phy->mt76->band_idx,
3464 		},
3465 	};
3466 	int ret;
3467 	u8 max_th = 82, non_srg_max_th = 62;
3468 
3469 	/* disable firmware dynamical PD asjustment */
3470 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_DPD, false);
3471 	if (ret)
3472 		return ret;
3473 
3474 	if (he_obss_pd->sr_ctrl &
3475 	    IEEE80211_HE_SPR_NON_SRG_OBSS_PD_SR_DISALLOWED)
3476 		req.param.pd_th_non_srg = max_th;
3477 	else if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT)
3478 		req.param.pd_th_non_srg  = max_th - he_obss_pd->non_srg_max_offset;
3479 	else
3480 		req.param.pd_th_non_srg  = non_srg_max_th;
3481 
3482 	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_SRG_INFORMATION_PRESENT)
3483 		req.param.pd_th_srg = max_th - he_obss_pd->max_offset;
3484 
3485 	req.param.obss_pd_min = cpu_to_le16(82);
3486 	req.param.obss_pd_min_srg = cpu_to_le16(82);
3487 	req.param.txpwr_restrict_mode = 2;
3488 	req.param.txpwr_ref = 21;
3489 
3490 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3491 				 sizeof(req), true);
3492 }
3493 
3494 static int
3495 mt7915_mcu_set_obss_spr_siga(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3496 			     struct ieee80211_he_obss_pd *he_obss_pd)
3497 {
3498 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3499 	struct mt7915_dev *dev = phy->dev;
3500 	u8 omac = mvif->mt76.omac_idx;
3501 	struct {
3502 		struct mt7915_mcu_sr_ctrl ctrl;
3503 		struct {
3504 			u8 omac;
3505 			u8 rsv[3];
3506 			u8 flag[20];
3507 		} __packed siga;
3508 	} __packed req = {
3509 		.ctrl = {
3510 			.action = SPR_SET_SIGA,
3511 			.argnum = 1,
3512 			.band_idx = phy->mt76->band_idx,
3513 		},
3514 		.siga = {
3515 			.omac = omac > HW_BSSID_MAX ? omac - 12 : omac,
3516 		},
3517 	};
3518 	int ret;
3519 
3520 	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_HESIGA_SR_VAL15_ALLOWED)
3521 		req.siga.flag[req.siga.omac] = 0xf;
3522 	else
3523 		return 0;
3524 
3525 	/* switch to normal AP mode */
3526 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_MODE, 0);
3527 	if (ret)
3528 		return ret;
3529 
3530 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3531 				 sizeof(req), true);
3532 }
3533 
3534 static int
3535 mt7915_mcu_set_obss_spr_bitmap(struct mt7915_phy *phy,
3536 			       struct ieee80211_he_obss_pd *he_obss_pd)
3537 {
3538 	struct mt7915_dev *dev = phy->dev;
3539 	struct {
3540 		struct mt7915_mcu_sr_ctrl ctrl;
3541 		struct {
3542 			__le32 color_l[2];
3543 			__le32 color_h[2];
3544 			__le32 bssid_l[2];
3545 			__le32 bssid_h[2];
3546 		} __packed bitmap;
3547 	} __packed req = {
3548 		.ctrl = {
3549 			.action = SPR_SET_SRG_BITMAP,
3550 			.argnum = 4,
3551 			.band_idx = phy->mt76->band_idx,
3552 		},
3553 	};
3554 	u32 bitmap;
3555 
3556 	memcpy(&bitmap, he_obss_pd->bss_color_bitmap, sizeof(bitmap));
3557 	req.bitmap.color_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3558 
3559 	memcpy(&bitmap, he_obss_pd->bss_color_bitmap + 4, sizeof(bitmap));
3560 	req.bitmap.color_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3561 
3562 	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap, sizeof(bitmap));
3563 	req.bitmap.bssid_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3564 
3565 	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap + 4, sizeof(bitmap));
3566 	req.bitmap.bssid_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3567 
3568 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3569 				 sizeof(req), true);
3570 }
3571 
3572 int mt7915_mcu_add_obss_spr(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3573 			    struct ieee80211_he_obss_pd *he_obss_pd)
3574 {
3575 	int ret;
3576 
3577 	/* enable firmware scene detection algorithms */
3578 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_SD, sr_scene_detect);
3579 	if (ret)
3580 		return ret;
3581 
3582 	/* firmware dynamically adjusts PD threshold so skip manual control */
3583 	if (sr_scene_detect && !he_obss_pd->enable)
3584 		return 0;
3585 
3586 	/* enable spatial reuse */
3587 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE, he_obss_pd->enable);
3588 	if (ret)
3589 		return ret;
3590 
3591 	if (sr_scene_detect || !he_obss_pd->enable)
3592 		return 0;
3593 
3594 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_TX, true);
3595 	if (ret)
3596 		return ret;
3597 
3598 	/* set SRG/non-SRG OBSS PD threshold */
3599 	ret = mt7915_mcu_set_obss_spr_pd(phy, he_obss_pd);
3600 	if (ret)
3601 		return ret;
3602 
3603 	/* Set SR prohibit */
3604 	ret = mt7915_mcu_set_obss_spr_siga(phy, vif, he_obss_pd);
3605 	if (ret)
3606 		return ret;
3607 
3608 	/* set SRG BSS color/BSSID bitmap */
3609 	return mt7915_mcu_set_obss_spr_bitmap(phy, he_obss_pd);
3610 }
3611 
3612 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3613 			   struct ieee80211_sta *sta, struct rate_info *rate)
3614 {
3615 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3616 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3617 	struct mt7915_dev *dev = phy->dev;
3618 	struct mt76_phy *mphy = phy->mt76;
3619 	struct {
3620 		u8 category;
3621 		u8 band;
3622 		__le16 wcid;
3623 	} __packed req = {
3624 		.category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3625 		.band = mvif->mt76.band_idx,
3626 		.wcid = cpu_to_le16(msta->wcid.idx),
3627 	};
3628 	struct ieee80211_supported_band *sband;
3629 	struct mt7915_mcu_phy_rx_info *res;
3630 	struct sk_buff *skb;
3631 	int ret;
3632 	bool cck = false;
3633 
3634 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3635 					&req, sizeof(req), true, &skb);
3636 	if (ret)
3637 		return ret;
3638 
3639 	res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3640 
3641 	rate->mcs = res->rate;
3642 	rate->nss = res->nsts + 1;
3643 
3644 	switch (res->mode) {
3645 	case MT_PHY_TYPE_CCK:
3646 		cck = true;
3647 		fallthrough;
3648 	case MT_PHY_TYPE_OFDM:
3649 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3650 			sband = &mphy->sband_5g.sband;
3651 		else if (mphy->chandef.chan->band == NL80211_BAND_6GHZ)
3652 			sband = &mphy->sband_6g.sband;
3653 		else
3654 			sband = &mphy->sband_2g.sband;
3655 
3656 		rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3657 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
3658 		break;
3659 	case MT_PHY_TYPE_HT:
3660 	case MT_PHY_TYPE_HT_GF:
3661 		if (rate->mcs > 31) {
3662 			ret = -EINVAL;
3663 			goto out;
3664 		}
3665 
3666 		rate->flags = RATE_INFO_FLAGS_MCS;
3667 		if (res->gi)
3668 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3669 		break;
3670 	case MT_PHY_TYPE_VHT:
3671 		if (rate->mcs > 9) {
3672 			ret = -EINVAL;
3673 			goto out;
3674 		}
3675 
3676 		rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3677 		if (res->gi)
3678 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3679 		break;
3680 	case MT_PHY_TYPE_HE_SU:
3681 	case MT_PHY_TYPE_HE_EXT_SU:
3682 	case MT_PHY_TYPE_HE_TB:
3683 	case MT_PHY_TYPE_HE_MU:
3684 		if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
3685 			ret = -EINVAL;
3686 			goto out;
3687 		}
3688 		rate->he_gi = res->gi;
3689 		rate->flags = RATE_INFO_FLAGS_HE_MCS;
3690 		break;
3691 	default:
3692 		ret = -EINVAL;
3693 		goto out;
3694 	}
3695 
3696 	switch (res->bw) {
3697 	case IEEE80211_STA_RX_BW_160:
3698 		rate->bw = RATE_INFO_BW_160;
3699 		break;
3700 	case IEEE80211_STA_RX_BW_80:
3701 		rate->bw = RATE_INFO_BW_80;
3702 		break;
3703 	case IEEE80211_STA_RX_BW_40:
3704 		rate->bw = RATE_INFO_BW_40;
3705 		break;
3706 	default:
3707 		rate->bw = RATE_INFO_BW_20;
3708 		break;
3709 	}
3710 
3711 out:
3712 	dev_kfree_skb(skb);
3713 
3714 	return ret;
3715 }
3716 
3717 int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3718 				struct cfg80211_he_bss_color *he_bss_color)
3719 {
3720 	int len = sizeof(struct sta_req_hdr) + sizeof(struct bss_info_color);
3721 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3722 	struct bss_info_color *bss_color;
3723 	struct sk_buff *skb;
3724 	struct tlv *tlv;
3725 
3726 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
3727 					      NULL, len);
3728 	if (IS_ERR(skb))
3729 		return PTR_ERR(skb);
3730 
3731 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR,
3732 				      sizeof(*bss_color));
3733 	bss_color = (struct bss_info_color *)tlv;
3734 	bss_color->disable = !he_bss_color->enabled;
3735 	bss_color->color = he_bss_color->color;
3736 
3737 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3738 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
3739 }
3740 
3741 #define TWT_AGRT_TRIGGER	BIT(0)
3742 #define TWT_AGRT_ANNOUNCE	BIT(1)
3743 #define TWT_AGRT_PROTECT	BIT(2)
3744 
3745 int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
3746 			       struct mt7915_vif *mvif,
3747 			       struct mt7915_twt_flow *flow,
3748 			       int cmd)
3749 {
3750 	struct {
3751 		u8 tbl_idx;
3752 		u8 cmd;
3753 		u8 own_mac_idx;
3754 		u8 flowid; /* 0xff for group id */
3755 		__le16 peer_id; /* specify the peer_id (msb=0)
3756 				 * or group_id (msb=1)
3757 				 */
3758 		u8 duration; /* 256 us */
3759 		u8 bss_idx;
3760 		__le64 start_tsf;
3761 		__le16 mantissa;
3762 		u8 exponent;
3763 		u8 is_ap;
3764 		u8 agrt_params;
3765 		u8 rsv[23];
3766 	} __packed req = {
3767 		.tbl_idx = flow->table_id,
3768 		.cmd = cmd,
3769 		.own_mac_idx = mvif->mt76.omac_idx,
3770 		.flowid = flow->id,
3771 		.peer_id = cpu_to_le16(flow->wcid),
3772 		.duration = flow->duration,
3773 		.bss_idx = mvif->mt76.idx,
3774 		.start_tsf = cpu_to_le64(flow->tsf),
3775 		.mantissa = flow->mantissa,
3776 		.exponent = flow->exp,
3777 		.is_ap = true,
3778 	};
3779 
3780 	if (flow->protection)
3781 		req.agrt_params |= TWT_AGRT_PROTECT;
3782 	if (!flow->flowtype)
3783 		req.agrt_params |= TWT_AGRT_ANNOUNCE;
3784 	if (flow->trigger)
3785 		req.agrt_params |= TWT_AGRT_TRIGGER;
3786 
3787 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
3788 				 &req, sizeof(req), true);
3789 }
3790 
3791 int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx)
3792 {
3793 	struct {
3794 		__le32 cmd;
3795 		__le32 num;
3796 		__le32 __rsv;
3797 		__le16 wlan_idx;
3798 	} req = {
3799 		.cmd = cpu_to_le32(0x15),
3800 		.num = cpu_to_le32(1),
3801 		.wlan_idx = cpu_to_le16(wlan_idx),
3802 	};
3803 	struct mt7915_mcu_wa_tx_stat {
3804 		__le16 wlan_idx;
3805 		u8 __rsv[2];
3806 
3807 		/* tx_bytes is deprecated since WA byte counter uses u32,
3808 		 * which easily leads to overflow.
3809 		 */
3810 		__le32 tx_bytes;
3811 		__le32 tx_packets;
3812 	} *res;
3813 	struct mt76_wcid *wcid;
3814 	struct sk_buff *skb;
3815 	int ret;
3816 
3817 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WA_PARAM_CMD(QUERY),
3818 					&req, sizeof(req), true, &skb);
3819 	if (ret)
3820 		return ret;
3821 
3822 	if (!is_mt7915(&dev->mt76))
3823 		skb_pull(skb, 4);
3824 
3825 	res = (struct mt7915_mcu_wa_tx_stat *)skb->data;
3826 
3827 	if (le16_to_cpu(res->wlan_idx) != wlan_idx) {
3828 		ret = -EINVAL;
3829 		goto out;
3830 	}
3831 
3832 	rcu_read_lock();
3833 
3834 	wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
3835 	if (wcid)
3836 		wcid->stats.tx_packets += le32_to_cpu(res->tx_packets);
3837 	else
3838 		ret = -EINVAL;
3839 
3840 	rcu_read_unlock();
3841 out:
3842 	dev_kfree_skb(skb);
3843 
3844 	return ret;
3845 }
3846 
3847 int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
3848 {
3849 	struct {
3850 		__le32 idx;
3851 		__le32 ofs;
3852 		__le32 data;
3853 	} __packed req = {
3854 		.idx = cpu_to_le32(u32_get_bits(regidx, GENMASK(31, 24))),
3855 		.ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(23, 0))),
3856 		.data = set ? cpu_to_le32(*val) : 0,
3857 	};
3858 	struct sk_buff *skb;
3859 	int ret;
3860 
3861 	if (set)
3862 		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
3863 					 &req, sizeof(req), false);
3864 
3865 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
3866 					&req, sizeof(req), true, &skb);
3867 	if (ret)
3868 		return ret;
3869 
3870 	*val = le32_to_cpu(*(__le32 *)(skb->data + 8));
3871 	dev_kfree_skb(skb);
3872 
3873 	return 0;
3874 }
3875